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Abstract 

We show that every language in NP has a PCP verifier that tosses O(logn) random coins, 
has perfect completeness, and a soundness error of at most 1 /poly(n), while making at most 
0(poly log log n) queries into a proof over an alphabet of size at most n 1 / polylogl ° sn . Previous 
constructions that obtain l/poly(n) soundness error used either poly log n queries or an expo¬ 
nential sized alphabet, i.e. of size 2 n for some c > 0. Our result is an exponential improvement 
in both parameters simultaneously. 

Our result can be phrased as a polynomial-gap hardness for approximate CSPs with arity 
poly log log n and alphabet size b 1 /poly log ry The ultimate goal, in this direction, would be to 
prove polynomial hardness for CSPs with constant arity and polynomial alphabet size (aka the 
sliding scale conjecture for inverse polynomial soundness error). 

Our construction is based on a modular generalization of previous PCP constructions in this 
parameter regime,which involves a composition theorem that uses an extra 'consistency' query 
but maintains the inverse polynomial relation between the soundness error and the alphabet 
size. 

Our main technical / conceptual contribution is a new notion of soundness, which we refer 
to as distributional soundness, that replaces the previous notion of "list decoding soundness", 
and that allows us to prove a modular composition theorem with tighter parameters. This 
new notion of soundness allows us to invoke composition a super-constant number of times 
without incurring a blow-up in the soundness error. 
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1 Introduction 


Probabilistically checkable proofs (PCPs) provide a proof format that enables verification with 
only a small number of queries into the proof such that the verification, though probabilistic, has 
only a small probability of error. This is formally captured by the following notion of a probabilis¬ 
tic verifier. 

Definition 1.1 (PCP Verifier). A PCP verifier V for a language L is a polynomial time probabilistic 
algorithm that behaves as follows: On input x, and oracle access to a (proof) string II (over an alphabet 
£), the verifier reads the input x, tosses some random corns R, and based on x and R computes a (local) 
window I = (ii,... ,i q ) of q indices to read from II, and a (local) predicate ip : Tfl —> {0,1}. The verifier 
then accepts iffip(U\j) = 1. 

• The verifier has perfect completeness: if for every x € L, there is a proof II that is accepted with 
probability 1. I.e., 311, PrR[<p(II|/) = 1] = 1. 

• The verifier has soundness error 5 < 1: if for any x L, every proof U is accepted zvith probability 
at most 5. I.e., VII, Pr^[(p(II|/) = 1] < 6. 

The celebrated PCP Theorem [AS98, ALM + 98] states that every language in NP has a verifier 
that has perfect completeness and soundness error bounded by a constant 5 < 1, while using only 
a logarithmic number of random coins, and reading only q = 0(1) proof bits. Naturally (and 
motivated by the fruitful connection to inapproximability due to Feige et al. [FGL + 96]), much 
attention has been given to obtaining PCPs with desirable parameters, such as a small number of 
queries q, smallest possible soundness error <5, and smallest possible alphabet size |£|. 

How small can we expect the soundness error 5 to be? There are a couple of obvious limita¬ 
tions. First observe that the soundness error 5 cannot be smaller than l/poly(n) just because there 
are only poly(n) different random choices for the verifier and at least one of the corresponding 
local predicates must be satisfiable 1 . Next, note that if the verifier reads a total of k bits from 
the proof (namely, glog |£| < /.:), the soundness error cannot be smaller than 2~ k , just because a 
random proof is expected to cause the verifier to accept with at least this probability. 

The best case scenario is thus if one can have the verifier read k = 0(log n) bits from the proof 
and achieve a soundness error of l/2 k = l/poly(?r). Indeed, the following is well known (obtained 
by applying a randomness efficient sequential repetition to the basic PCP Theorem): 

Theorem 1.2 (PCP theorem + randomness efficient sequential repetition). For every integer k, every 
language in NP has a PCP verifier that tosses at most 0(k + log n) random coins, makes q = 0(k) queries 
into a proof over the Boolean alphabet {0,1}, has perfect completeness, and soundness error 5 = 2~ k . 

In particular, setting k = log nzve get q = O(logn) and 5 = l/poly(n). 

This theorem gives a ballpark optimal tradeoff (up to constants) between soundness error and 
the number of bits read from the proof. However it does not achieve a small number of queries, a 
fundamental requirement that is important, among other things, for hardness of approximation. 
The goal of constructing a PCP with both a small error and a small number of queries turns out to 
be much more challenging and has attracted considerable attention. This was first formulated by 
Bellare et al. [BGLR93] as the "sliding scale" conjecture. 

, ? 

One may assume that every local predicate tp is satisfiable. Otherwise the question of “x £ L" reduces to the 

question of whether i p is satisfiable for any of the predicates computed by the verifier. This cannot occur without a 
collapse of NP into NTIME (q log | E |). 
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Conjecture 1.3 (Sliding Scale Conjecture [BGLR93]). For any jlo! l /iri) < 5 < 1, every language in NP 
has a PCP verifier that tosses 0(log n) random corns, makes q = 0(1) queries 2 into a proof over an alphabet 
£ of size poly (1/5), has perfect completeness, and soundness error 5. 

As we describe shortly below, this conjecture is known to hold for 1 > 5 > 2 ( lo s n ) 1 , namely 
where 5 can be made 'almost' polynomially small. The interesting regime, that has remained open 
for two decades, is that of (inverse) polynomially small 5. This is the focus of our work. Our main 
goal is to find the smallest q and |£| parameters for which we can get 5 to be polynomially small. 
Our main result is the following. 

Main Theorem 1.4. Every language in NP has a PCP verifier that tosses O(logn) random bits, makes 
q = (loglogn) 0 ^) queries into a proof over an alphabet £ of size |£| = 77 1// ( loglogTl ) 0(1) , has perfect 
completeness, and soundness error 5 = l/poly(n). 

Previous PCP constructions require at least (log rif lt 1 ) queries in order to achieve polynomially 
small error (and this remains true even for constructions that are allowed quasi-polynomial size, 
see further discussion at the end of this introduction). 

The first works making progress towards this conjecture are due to Raz and Safra [RS97], and 
Arora and Sudan [AS03], and rely on the classical (algebraic) constructions of PCPs. They prove 
the conjecture for all <5 such that 5 > 2 l ' log, '+ i f or some constant 6 > 0. These ideas were then 
extended by Dinur et al. [DFK+11] with an elaborate composition-recursion structure, proving the 
conjecture for all 5 > 2~ (lo sA for any e > 0. The small catch here is that the number of queries 
grows as e approaches 0. The exact dependence of q on e was not explicitly analyzed in [DFK+11], 
but we show that it can be made 0( 1/e) while re-deriving their result. 

Theorem 1.5 ([DFK+11]). For every e > 0 and 5 = 2 ( log n> ' " , every language in NP has a PCP verifier 
that tosses O(logn) random coins, makes q = 0( 1/e) queries into a proof over an alphabet £ of size 
|£| = l/poly(5), has perfect completeness, and has soundness error 5. 

The focus of [DFK+11] was on a constant number of queries but their result can also be applied 
towards getting polynomially small error with a non-trivially small number of queries. This is 
done by combining it with sequential repetition. We get. 

Corollary 1.6 ([DFK+11] + randomness efficient sequential repetition). For every e > 0, every lan¬ 
guage in NP has a PCP verifier that tosses O(logn) random coins, makes q = 0((\ogn) £ /e) queries into 
a proof over an alphabet £ of size |£| = 2( logn ) 1 e , has perfect completeness, and has soundness error 
5 = l/poly(n). 

Corollary 1.6 describes the previously known best result in terms of minimizing the number of 
queries subject to achieving a polynomially small error and using at most a logarithmic amount of 
randomness. Whereas in Corollary 1.6 the number of queries is q = (log n) £ , our Main Theorem 1.7 
requires only q = poly log log n queries. 

PCP Composition and dPCPs 

Like in recent improved constructions of PCPs [BGH+06, DR06, BS08, Din07, MR10, DH13], our 
main theorem is obtained via a better understanding of composition. All known constructions 

2 It is even conjectured that this constant can be made as low as 2. 
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of PCPs rely on proof composition. This paradigm, introduced by Arora and Safra [AS98], is a 
recursive procedure applied to PCP constructions to reduce the alphabet size. The idea is to start 
with an easier task of constructing a PCP over a very large alphabet S. Then, proof composition 
is applied (possibly several times over) to PCPs over the large alphabet to obtain PCPs over a 
smaller (even binary) alphabet, while keeping the soundness error small. 

In the regime of high soundness error (greater than 1/2), composition is by now well under¬ 
stood using the notion of PCPs of proximity [BGH+06] (called assignment testers in [DR06]) (see also 
[Sze99]). The idea is to bind the PCP proof of a statement to an NP witness for it, so that the veri¬ 
fier not only checks that the statement is correct but also that the given witness is (close to) a valid 
one. This extension allows one to prove a modular composition theorem, which is oblivious to 
the inner makings of the PCPs being composed. This modular approach has facilitated alternate 
proofs of the PCP theorem and constructions of shorter PCPs [BGH 1 06, BS08, Din07], However, 
the notion of a PCP of proximity, or assignment tester, is not useful for PCPs with low-soundness 
error. The reason is that for small S we are in a "list decoding regime", in that the PCP proof can 
be simultaneously correlated with more than one valid NP witness. 

The works mentioned earlier [RS97, AS03, DFK + 11] addressed this issue by using a notion of 
local list-decoding. This was called a local-reader in [DFK + 11] and formalized nicely as a locally- 
decode-or-reject-code (LDRC) by Moshkovitz and Raz [MR10]. Such a code allows "local decod¬ 
ing" in that for any given string w there is a list of valid codewords {c \..... cj j } such that when 
the verifier is given a tuple of indices j i,..., jk, then but for an error probability of 5, the verifier 
either rejects or outputs (ci)\j ly ...j k for some i € [L]. 

Decodable PCPs (dPCPs) Dinur and Harsha [DH13] introduced the notion of a PCP decoder 
(dPCP), which extends the earlier definitions of LDRCs and local-readers from codes to PCP veri¬ 
fiers. A PCP decoder is like a PCP verifier except that it also gets as input an index j (or a tuple of 
indices). The PCP decoder is supposed to check that the proof is correct, and to also return the j-th 
symbol of the NP witness encoded by the PCP proof. As in previous work, the soundness guaran¬ 
tee for dPCPs is that for any given proof II there is a short list of valid NP witnesses {xi,, xl} 
such that except with probability 5 the verifier either rejects or outputs (:c,;)( ? for some x, in the 
list. 

The main advantage of dPCPs is that they allow a modular composition theorem in the regime 
of small soundness error. The composition theorem proved by Dinur and Harsha [DH13] was a 
two-query composition theorem, generalizing from the ingenious construction of Moshkovitz and 
Raz [MR10]. The two-query requirement is a stringent one, and in this construction it inherently 
causes an exponential increase in the alphabet, so that instead of |S| = poly(1/5) one gets a PCP 
with |£| = exp(poly(l/5)). 

In this work we give a different (modular) dPCP composition theorem. Essentially, our the¬ 
orem is a modular generalization of the composition method, as done implicitly in previous 
works [RS97, AS03, DFK+11], which uses an extra 'consistency' query but maintains the inverse 
polynomial relation between S and |£|. 

We remark that unlike recent PCP constructions [BGH+06, DR06, MR10, DH13] which recurse 
on the large (projection) query of the outer PCP, our composition recurses on the entire test as 
was done originally by Arora and Safra [AS98]. This aspect of the composition is explained and 
abstracted nicely in [Mosl4], 
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Distributional Soundness Our main technical/conceptual contribution is a new notion of sound¬ 
ness, which we refer to as distributional soundness, which replaces the previous notion of list decod¬ 
ing soundness described above, and allows us to apply a non-constant number of compositions 
without a blowup in the error. 

We say that a verifier has distributional soundness 6 if its output is "/-indistinguishable" from 
the output of an idealized verifier. The idealized verifier has access to a distribution II over valid 
proofs or _L. When it is run with random coins R it samples a proof \ \{R) from this distribution and 
either rejects if II(T!) = _ or outputs what the actual verifier would output when given access to 
I!(/?.). By /-indistinguishable, we mean that there is a coupling between the actual verifier and the 
idealized verifier, such that the probability that the verifier does not reject and its output differs 
from the output of the idealized verifier, is at most /. 

The advantage of moving from list decoding soundness to distributional soundness, is that it 
removes the extra factor of T m (the list size) incurred in previous composition analyses. Recall that, 
e.g. in the composition theorem of Dinur-Harsha [DH13], one takes an outer PCP with soundness 
Z ou t and an inner PCP decoder with soundness c) m and out comes a PCP with soundness Z m + 
Tin • /out- This is true in all (including implicit) prior composition analyses. When making only a 
constant number of composition steps, this is not an issue, but when the number t of composition 
steps grows, the soundness is at least (Tin)* ■ /out and this is too expensive for the parameters we 
seek. Using distributional soundness, we prove that the composition of a PCP with soundness 
error Z out and a dPCP with soundness error () m yields a PCP with soundness error Z out + Z m + r/ 
where rj is an error term that is related to the distance of an underlying error correcting code, 
and can be controlled easily. Thus, after t composition steps the soundness error will only be 
0(t(S + rj)). 

We remark that this notion of soundness, though new, is satisfied by most of the earlier PCP 
constructions (at least the ones based on the low-degree test). In particular, it can be shown that 
list-decoding soundness and very good error-correcting properties of the PCP imply distributional 
soundness. 

Proof Overview 

At a high level, our main theorem is derived by adopting the recursive structure of the construc¬ 
tion in [DFK+11], The two main differences are the use of our modular composition theorem, and 
the soundness analysis that relies on the notion of distributional soundness 3 . 

We fix a field F at the outset and use the same field throughout the construction. This is 
important for the interface between the outer and the inner dPCPs, as it provides a convenient 
representation of the output of the outer dPCP as an arithmetic circuit over F, which is then the 
input for the inner dPCP. 

As in the construction of [DFK+11], we take |F| ~ 2' logr '- 1 ' “ and begin by constructing PCPs 
over a fairly large alphabet size which we gradually reduce via composition. The initial alphabet 

size is 2 2(1 ° sn) , and then it drops to 2 2(1 ° s,1> and then to 2 2<1 ° s " ) and so on. After 1/e 

3 Looking at the construction as it is presented here, one may ask, why wasn't this done back in 1999, when the 
conference version of [DFK + 11] was published. This construction is notoriously far from modular. Thus, tweaking pa¬ 
rameters, following them throughout the construction, and making the necessary changes, would have been a daunting 
task. Without the modular approach it was not at all clear what the bottlenecks were, let alone address them. 
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steps we make a couple of final composition steps and end up with the desired alphabet size of 
2( logTl ) 1 , logarithmic in the initial alphabet size. 

Unlike the construction in [DFK + 11], we can afford to plug in a sub-constant value for e, 
and we take e = c log log log n/ log log n for some constant c so that 2( logn ^ e = 2 logn /( loglogri ) t: = 

n l/(l°glogn) c _ 

The number of composition steps is 0(l/e), resulting in a PCP with O(loglogn) queries and 
soundness error nV( loglog ”) c for some constant c < 3 (see Theorem 5.1). Finally, (loglogn) c steps 
of (randomness-efficient) sequential repetition yield a PCP with polynomially small error and 
poly log log n queries as stated in Main Theorem 1.7. It can be shown that the parameters obtained 
in Theorem 5.1 (namely, soundness error n l ' / ^ oglogn ^ 0, ' ) is tight given the basic Reed-Muller and 
Hadamard based building blocks (see § 5.3 for details). 

Further Background and Motivation 

Every PCP theorem can be viewed as a statement about the local-vs.-global behaviour of proofs, 
in that the correctness of a proof, which is clearly a global property, can be checked by local checks, 
on average. The parameters of the PCP (number of queries, soundness error, alphabet size) give a 
quantitative measure to this local to global behavior. The sliding scale conjecture essentially says 
that even with a constant number of queries, this local to global phenomenon continues to hold, 
for all ranges of the soundness error. 

Another motivation for minimizing the number of queries becomes apparent when consider¬ 
ing interaction with provers instead of direct access to proofs (i.e. MIP instead of PCP). A PCP 
protocol can not in general be simulated by a protocol between a verifier and a prover because 
the prover might cheat by adaptively changing her answers. This can be sidestepped by sending 
each query to a different prover, such that the provers are not allowed to communicate with each 
other. This is the MIP model of Ben-Or et al. [BGKW88]. It is only natural to seek protocols using 
the smallest number of (non-communicating) provers. 

The importance of the sliding scale conjecture stems, in addition to the fundamental nature of 
the question, from its applications to hardness of approximation. First, it is known that every PCP 
theorem can be phrased as a hardness-of-approximation for Max-CSP: the problem of finding 
an assignment that satisfies a maximal number of constraints in a given constraint system. The 
soundness error translates to the approximation factor, the alphabet of the proof is the alphabet of 
the variables, and the number of queries becomes the arity of the constraints in the CSP 

The main goal of this paper can be phrased as proving polynomial hardness of approximation 
factors for CSPs with smallest possible arity (and over an appropriately small alphabet). Our main 
theorem translates to the following result 

Theorem 1.7. It is NP-hard to decide if a given CSP zvith n variables and poly(n) constraints, is perfectly 
satisfiable or whether every assigmnent satisfies at most 1 /poly (n) fraction of the constraints. The CSP is 
such that each constraint has arity at most polyloglogn and the variables take values over an alphabet of 
size at most n 1 / loglogn ° ll) . 

In addition to the syntactic connection to Max-CSP, it is also known that a proof of the sliding 
scale conjecture would immediately imply polynomial factors inapproximability for DlRECTED- 
Sparsest-Cut and Directed-Multi-Cut [CK09]. 
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The results of [DFK+11] were used in [DS04] for proving hardness of approximation for a 
certain t p variant of label cover. However, that work mis-quoted the main result from [DFK + 11] 
as holding true even for a super-constant number of queries, up to yloglog ~n. In this work, we fill 
the gap proving the required PCP statement. We thank Michael Elkin for pointing this out. 

Further Discussion 

A possible alternate route to small soundness PCPs is via the combination of the basic PCP theo¬ 
rem [AS98, ALM+98] with the parallel repetition theorem [Raz98]. Applying A:-fold parallel repeti¬ 
tion yields a two-query PCP verifier over alphabet of size |£| = 2°^ k \ that uses 0(k log n) random 
bits, and has soundness error <5 = 2~ n ( k \ 

If we restrict to polynomial-size constructions, then parallel repetition is of no help compared 
to Theorem 1.2. If we allow k to be super constant, then more can be obtained. First, it is important 
to realize that the soundness error should be measured in terms of the output size, namely A = 
2 fclogn . For A’ = (log n) c a simple calculation shows log n = (log A) l//(r 1 d, and hence the soundness 
error is S(N) = 2 _ ( logn )' = 2 _ ( 1 °g A 9 1 1/(c+1) . This is no better than the result of [DFK+11] in terms 
of the soundness error, and in fact, worse in terms of the instance size blow up (A = 2 ( - l ° s "- i " as 
opposed to A = n° ( ^). Even parameters similar to our main theorem can be obtained, albeit with 
an almost exponential blowup. Consider k = sjn for example. In this case logn = 2 log log A — 
©(logloglog A), and so 5(N) = 2 - ^ = A -1 / e ( loglogiV ). From here, to get a polynomially small 
error one can take O (log log A) rounds of (randomness efficient) sequential repetition, coming up 
with a result that is similar to our Main Theorem 1.7 but with a huge blow up (A = n^" as 
opposed to A = n 0( V} ). 

We remark that a natural approach towards the sliding scale conjecture is to try and find a 
randomness-efficient version of parallel repetition to match the parameters of Theorem 1.2 but with 
q = 0(1). Unfortunately, this approach has serious limitations [FK95] and has so-far been less 
successful than the algebra-and-composition route, see also [DM11, Mosl4]. 

Organization 

We begin with some preliminaries in § 2. We introduce and define dPCPs and distributional 
soundness in § 3. Our dPCPs have k provers which are analogous to (and stronger than) PCPs 
that make k queries. In § 4, we state and prove a modular composition theorem for two (algebraic) 
dPCPs. In § 5, we prove the main theorem, relying on specific "classical" constructions of PCPs 
that are given in § 6, one based on the Reed-Muller code and low degree test, and one based on the 
quadratic version of the Hadamard code. These PCPs are the same as in earlier constructs [RS97, 
AS03, DFK+11, MR10, DH13] except that here we prove that they have the stronger notion of 
small distributional soundness. 

2 Preliminaries 

2.1 Notation 

All circuits in this paper have fan-in 2 and fan-out 2, and we allow only unary NOT and binary 
AND Boolean operations as internal gates. The size of a Boolean circuit/predicate 4> is the number 
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of gates in <I>. Given a circuit/predicate $ : {0, l} n —t {0,1}, we denote by SAT(<f>) the set of 
satisfying assignments for <f>, i.e v 

SAT($) = {x £ {0, l} n | $(x) = 1} . 

We will refer to the following NP-complete language associated with circuits: 

CktSAT = {<F | $ is specified as a Boolean circuit and SAT(<F) 0} . 

We will follow the following convention regarding input lengths: n will refer to the length of the 
input to the circuit $ (i.e., $ : {0, l} n —> {0,1}) while N will refer to the size of the circuit/predicate 
(i.e., size(<f>) = N). Thus, N is the input size to the problem CktSAT. 

We will also refer to a similar language associated with arithmetic circuits. First, for some 
notation. Given a finite field F, we consider arithmetic circuits over F with addition (+) and 
multiplication (x) gates and constants from the field F. For a function <f> : F n — > F, the size of <F 
is the number of gates in the arithmetic circuit specifying <F. We denote by SAT(<1>) the set of all x 
such that <f>(x) = 0. 

Definition 2.1 (Algebraic Circuit SAT). Given afield F, the Algebraic-Circuit-Satisfiability problem, 
denoted by Alg-CktSATf, is defined asfollozvs: 

Alg-CktSATf = {T> | <I> is specified by an arithmetic circuit over F and SAT(<F) fi 0} . 

As in the case of CktSAT, n refers to the length of the input to the function $ (i.e., <F : F n —> F), while N 
refers to the size of the arithmetic circuit <I>. 


2.2 Error Correcting Codes 

Let E : F n -> F A be an error correcting code with relative distance 1 — p, i.e., for every x f x', 
Pr j£[N][E(x)j = E(x')j] < p. For a word w £ ¥ N that is not necessarily a correct codeword, 
we can consider the list of all "admissible" codewords, i.e. codewords that have a non-negligible 
correlation with w. We are interested in more than just a list: we want to associate with each index 
j £ [ N ] an element in that list in a unique way. This will allow us to treat w as a random variable 
W : for a random index j, the random variable IF (j ) will output the list-element associated with 
the jth index. 

Definition 2.2. Let r > 0 be a parameter an let w : [A] —> F. V\!e define the r-local decoding function 
of w with respect to the code E, W : [N] — F n U {_L}, asfollozvs: 

• The t- admissible zvordsfor w are 


agr T (w) 


jx £ F n 


Pr [E(x)i 

ie[iV] L 


w j] 



• For any j £ [ N ], if there is a unique zvord x £ agr T (u>) such that E(x)j = wj zve set W(j) = x. 
Otherzvise, zve set W(j) = _L. 
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Claim 2.3. Let E : F n — > F w be an error correcting code with relative distance 1 — p, let w : [iV] — > F, 
and let W : [IV] —> F n be its r-local decoding function with respect to E. Also, suppose that v : [iV] —> F 
is a legal codezvord, i.e., v = E(y) for some y € F n . Then 

Pr [vj = Wj and W(j) f y\ < t + Ap/r 2 . 
je[iV] 

Proof Without loss of generality, we may assume that r > 2yfp. Let us write agr T (w) = {xi,x 2 , • • •} 
and let Si = {j € [IV] | Wj = ( E(xi))j}. We say that j € [iV] is an ambiguous point for w if 
j G Si n S{i for some distinct i, i'. We first bound the fraction of ambiguous points for w. 

By inclusion-exclusion, for any l < |agr T (u;)| 


N > 


U USi 


> 


i 


Ei s ‘ 


\SinSi,\)>eTN 



pN, 


where we have used that by definition | Si \ > tN and by the distance of the code S, n ,SV < pN. 
This implies that for every t < |agr T (w)|, 


1 > It 


(^jp > £t-£ 2 t 2 /8 


which clearly fails if £ = 2/r, so |agr T (ic)| < 2/r and so 



Now the event [vj = Wj and W(j) f y\ can occur either if j is an ambiguous point for w, or if 
v is not r-admissible with respect to w. But the former happens with probability at most 4p/r 2 
by (2.1), and the latter happens with probability at most r, as otherwise v would have been r- 
admissible. □ 


Remark 2.4. We minimize the quantity r+4p/r 2 , by setting r = (4//.) 1 //;i . We refer to this minimum 
as the agreement parameter p of the code E. Thus, rj = 2r = 2(4^) 1 / 3 . 


3 PCPs with distributional soundness 

3.1 Standard PCPs 

We begin by recalling the definition of a standard Approver projection PCP verifier. 

Definition 3.1 (PCP verifier). 

• A /c-prover projection PCP verifier over alphabet F is a probabilistic-time algorithm V that on input 
4>, a circuit of size N and a random input R ofr(N) random bits generates a tuple (q, ip,g) where 
q = (u,v i..., Vk- i) is a vector of k queries, ip : F m -> {0,1} is a predicate, and g = (gi ,..., gk-i) 
is a list ofk — 1 functions gi : F m — > F such that the size of the tuple (tp, g) is at most s(N). 

• We write (q, <p,g) = V (4 1 ; R ) to denote the query-predicate-function tuple output by the verifier V 
on input and random input R. 
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• It is good to keep in mind the k = 2 case as it captures all of the difficulty. In this case the output ofV 
is a label cover instance, when enumerating over all of V's random inputs. (The query pairs specify 
edges ( u, v ) and (ip, g ) specify which pairs of labels are acceptable). 

• WethinkofV as a probabilistic oracle machine that on input (<3> R) queries k provers II = (A, B \,..., B k - 1 ) 
at positions q = (u,v 1 ,..., v k -\) respectively to receive the answers n| g := (A(u), B\(vi),..., B k _ i(u fc _i)) 
£ F m x F fc_1 , and accepts iff the following checks pass: p(A(u)) = 1 and gi(A(u )) = Bi{vf) for all 

• Given k provers II = (A, B\,..., B k _y), we zvill sometimes collectively refer to them as the "proof 
II" . Furthermore, we refer to A as the large prover and the Bfs as the projection provers. We call 
n|, the local view of the proof II on queries q and denote by I/ n (<I>; R) the output of the verifier V on 
input (T>; R) when interacting with the k provers II. Thus, F n (<3>; R) = ACC if the checks pass and 
is rej otherwise. 

• We call N the input size, k the number of provers, r(N) the randomness complexity, and s(N) 
the answer size of the verifier V. 

Definition 3.2 (standard PCPs). For a function 6 : Z + —> [0,1], a k-prover projection PCP verifier V is a 
k-prover probabilistically checkable proof system for CktSAT with soundness error 6 if the following 
completeness and soundness properties hold for every circuit <I>: 

Completeness: Ifx £ SAT(3>), then there exist k provers II = (A, B i,..., B k ~ i) that cause the verifier 
V to accept with probability 1. Formally, 

3n = (A, B u ... t B k -i), Pr [C n ($; R) = ACC] = 1. 

In this case, we say that II is a valid proof for the statement x £ SAT(<I>). 

Soundness: If $ f CktSAT (i.e, SAT(<3?) = 0), then for every k provers II = (A, B \,..., B k - 1 ), the 
verifier V accepts $ with probability at most S(N). Formally, 

vn = (A, B u ..., B k -i), Pr [y n (^>; R) = ACC] < 5(N). 

R 

We then say that CktSAT has a k-prover projective PCP with soundness error 5. 

3.2 Distributional Soundness 

We now present distributional soundness, a strengthening of the standard PCP soundness condition 
that we find to be very natural. Informally, distributional soundness means that the event of the 
verifier accepting is roughly the same as the event of the local view of the verifier being consistent 
with a globally consistent proof, up to "the soundness error". I.e., 

Pr[ accept ] = Pr[ accept and the local view agrees with a correct proof ] ± 5. 

Thus, the local acceptance of the verifier is "fully explained" in terms of global consistency. 

A little more formally, every purported proof II (valid or not) can be coupled with an "ideal¬ 
ized" distribution 11(1?) over valid proofs and _L such that the behavior of the verifier on random 
string R when interacting with the proof II is identical to the corresponding behavior when in¬ 
teracting with the "idealized" proof II(i?) upto an error of 5, which we call the distributional 
soundness error. Formally, 
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Definition 3.3 (Distributional Soundness for Approver PCPs). For a function 5 : Z + — > [0,1], a Im¬ 
prover projection PCP verifier V for CktSAT is said to have distributional soundness error 5 if for every 
circuit $ and any set ofprovers n = (A, B\,... , Bp.-] ) there is an 'idealized pair' of functions x(R) and 
n(f?) defined for every random string R such that the following holds. 

• For every random string R, n(f?) is either a valid proof for the statement x(R.) G SAT(&), or 
fi (R) = ±. 

• With probability at least 1 — 6 over the choice of the random string R, the local view of the provers II 
completely agrees with the local view of the provers n(h!) or is a rejecting local viezv. In other words, 


Pr 

R 


V U (<F;R) = JL or U\ q = n(i?)|, >1-5, 


where q is the query vector generated by the PCP verifier V on input (4>; R). 


When the local viezvs agree, i.e. n| 9 = n(f?)| 9 , we say that II is successful (in explaining the success 
of ID. 


The advantage of distributional soundness is that it explains the acceptance probability of 
every proof II, valid or otherwise, in the following sense. Suppose a proof II is accepted with 
probability p. I.e., p fraction of the local views 111 f/ are "accepting". Then, it must be the case 
that but for an error probability of 5, each of these accepting views are projections of (possibly 
different) valid proofs. It is an easy consequence of this, that distributional soundness implies 
(standard) soundness. 


Proposition 3.4. IfCSAT has a k-prover PCP with distributional soundness error 5, then CktSAT has a 
k-prover PCP zvith (standard) soundness error 5. Furthermore, all other parameters (randomness, answer 
size, alphabet, perfect completeness) are identical. 

Proof. Suppose there exists a circuit <f> and a proof II such that Pr# [l /ir (T: R) = ACC] > S. Then, 
by the distributional soundness property it follows that there exists at least one local accepting 
view which is a projection of a valid proof. In particular, there exists a valid proof which implies 
$ g CktSAT. □ 


3.3 PCP decoders 

We now present a variant of PCP verifiers, called PCP decoders, introduced by Dinur and Har- 
sha [DH13]. PCP decoders, as the name suggests, have the additional property that they not only 
locally check the PCP proof II, but can also locally decode symbols of an encoding of the original NP 
witness from the PCP proof II. PCP decoders are implicit in many previous constructions of PCPs 
with small soundness error and were first explicitly defined under the name of local-readers by 
Dinur et al. [DFK + 11], as locally-decode-or-reject-codes (LDRC) by Moshkovitz and Raz [MR10] 
and as decodable PCPs by Dinur and Harsha [DH13]. As in the case of PCP verifiers, our PCP 
decoders will be projection PCP decoders. 
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Definition 3.5 (PCP decoder). 


• A k -prover /-answer projection PCP decoder over alphabet F and encoding length t is a probabilistic- 
tune algorithm V that on input (<I>, F) of size N, a random input string R ofr(N) random bits and 
an additional input index j E [t], where <1> : F n —> {0,1} is a predicate, and F = (F\.... ,P)_i) 

a list of l - l functions Fi : F n -> F, generates a tuple (q, y, g , /) where q = (u,v i..., Vk- 1 ) is a 
vector of k queries, y : F m —> {0,1} is a predicate, g = (gi,...,gk-i) is a list of k — l functions 
gi : F m —> F and f = (/o, • • ■, fi-i) is a list of l functions fi : F m —> F such that the size of the 
tuple ( <p , g, f ) is at most s(N). 

• We write (q,p,g,f) = T>($,F;R,j) to denote the query-predicate-functions tuple output by the 
decoder V on input pair (3>, F), random input R and input index j. 

• We think of V as a probabilistic oracle machine that on input (&,F;R,j) queries k provers n = 

B k _ i) at positions q = (u,vi, - ■ ■, v k -i) respectively to receive the answers n| g := 

(A(ii), Bi(vi ),..., B k -i{v k -i)) E F m x F fc_1 , then checks if p(A(u)) = 1 and gi(A(u )) = Bi{vi) 
for all i e {1,..., k— 1} and if these tests pass outputs thel-tuple ( fo(A(u )), fi(A(u)), ..., fi-i(A(u))) E 
¥ l+1 and otherwise outputs _L. 

• Given k provers II = (A, Bi,..., B k _\), we will sometimes collectively refer to them as the "proof 
II". Furthermore, we refer to A as the large prover and the Bfs as the projection provers. We call II| g 
the local view of the provers II on queries q and denote by P n ($, F\ R,j) the output of the decoder 
V on input (3>, F; R, j ) when interacting with the k provers II. Note that the output is an element of 
F i+1 U {_L}. 

• We call N the input size, k the number of provers, l the number of answers, r(N ) the random¬ 
ness complexity, and s(N ) the answer size of the decoder V. 

We now equip the above defined PCP decoders with the new notion of soundness, distribu¬ 
tional soundness. We find it convenient (and sufficient) to define decodable PCPs only for predi¬ 
cates and function tuples which have an algebraic structure over the underlying alphabet, which 
is the field F. In other words, both the input tuple ($, F) and output tuple (y. g, f) have the prop¬ 
erty that the predicates <P, y and the functions F. /, g are specified as arithmetic circuits over F. For 
the above reasons, we define dPCPs for Alg-CktSAT (see Definition 2.1). 

Definition 3.6 (decodable PCPs with distributional soundness). For 6 E (0,1) and a code E : F n —)• 

F*, a k-prover l-answer projection PCP decoder V is a fc-prover /-answer decodable probabilistically 
checkable proof system for Alg-CktSATV with respect to encoding E with distributional soundness 
error 5 if the following properties hold for every input pair (<3?, F): 

Perfect Completeness: For every x E SAT(3>), there exist k provers II = (A, B]..... B k ~ i) such that 
the PCP decoder V when interacting with provers II outputs (E(x)j, F\(x ),..., F)_i(x)) for every 
random input R and index j. I.e., 

Pr [D n (<F,F-,R,j) = (E(x)j,F i(x),..., FU(x))] = 1. 

n,3 

In other words, the decoder V on input (<f>, F; R, j ) outputs the j-th symbol of the encoding E(x) and 
the tuple F evaluated at x. In this case, we say that II is a valid proof/or the statement x E SAT($). 
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Distributional Soundness: For any set ofprovers II = (A , B i,, /i/._ i ) there exists an idealized pair 
of functions x(R ) and n(-R) defined for every random string R such that the following holds. 


• For every random string R, 11(1?) is either a valid proof for the statement x(R) e SAT($), or 

n (r) = ±. 

• For every j 6 {1, ..., t}, with probability at least 1 — 5 over the choice of the random string R, 
the local viezv of the provers II completely agrees with the local view of the provers II(i?) or is a 
rejecting local viezv. In other words, 


Vj G [t], 


Pr 

R 


V n (<F>,F-R,j) = ±orU\ q 




> 1 


5 , 


where q is the query vector generated by the PCP decoder V on input (<&, F; R, j). 

When the local views agree, i.e. II| g = n(i?)| g/ we say that II is successful (in explaining the 
success of FI). In this case zve have that D n (<l>, F; R,j) = (E(x(R))j, F(x(R))). 


We then say that V is a k-prover l-answer PCP decoder for Alg-CktSAT with respect to encoding E with 
perfect completeness and distributional soundness error 6. 

Remark 3.7. The above definition is a non-uniform one in the sense that it is defined for a particular 
choice of input lengths n, N, size of field F and encoding E : F n —> Fh A uniform version of the 
above definition can be obtained as follows: there exists a polynomial time uniform procedure 
that on input n, N (both in unary), the field F (specified by a prime number and an irreducible 
polynomial) and the encoding E (specified by the generator matrix) outputs the PCP decoder 
algorithm. We note that our construction satisfies this stronger uniform property 

As in previous works [MR10, DH13], dPCPs imply PCPs with similar parameters 

Proposition 3.8. If Alg-CktSAT has a k-prover dPCP with distributional soundness error 5, then 
Alg-CktSAT has a k-prover PCP with distributional soundness error 5. Furthermore, all other pa¬ 
rameters (randomness, answer size, alphabet, perfect completeness) are identical. 

We conclude this section highlighting the differences/similarities between the above notion of 
PCP decoders/dPCPs with that of Dinur and Harsha [DH13] besides the obvious difference in the 
soundness criterion. 


Remark 3.9. 


• The above definition of PCP decoders is a generalization of the corresponding definition of 
Dinur and Harsha [DH13] to the multi-prover (k > 2) setting. Since our PCP verifiers are 
multi-prover verifiers and not just 2-prover verifiers, so are our PCP decoders. Thus, in our 
notation, the PCP decoders of [DH13] are 2-prover l-answer projection PCP decoders. 

• The above defined PCP decoders locally decode symbols of some pre-specified encoding 
E of the NP-witness. The PCP decoders of Dinur and Harsha [DH13] is a special case of 
this when the encoding E is the identity encoding. However as we will see in the next sec¬ 
tion, it will be convenient to work with encodings which have good distance. In particular, 
the dPCP composition (considered in this paper) requires the encoding of the "inner" PCP 
decoder to have good distance. 
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Figure 1\ Composition of two 2-prover dPCPs V Q ut and V m to yield composed dPCP V corap . Note 
that Pi n , Pout make two queries each, and V comp makes four queries: w, z, (u,j- m ),v to A, B,C*,D 
respectively. 


4 Composition 

In this section, we describe how to compose two PCP decoders. Informally speaking, an "outer" 
PCP decoder P ou t can be composed with an "inner" PCP decoder P H1 if the answer size of the 
outer PCP decoder matches the input size of the inner PCP decoder and the number of answers 
of the inner PCP decoder is the sum of the number of answers of the outer PCP decoder and the 
number of provers of the outer PCP decoder. 

We begin with an informal description of the composition procedure. It might be useful to read 
this description while looking at Figure 4, in which there are three dPCPs: the inner, the outer, and 
the composed. We depict each dPCP as a bi-partite (or 4-partite) label-cover-like graph whose 
vertices correspond to proof locations, and whose (hyper-)edges correspond to local views of the 
PCP decoder. The main goal of composition is to reduce the answer size of the outer PCP decoder. 
By this we are referring to the answer size of the large prover; as it is always possible to reduce the 
answer size of projection provers at negligible cost. For simplicity, let us assume that each of the 
inner and the outer PCP decoders use only two provers. The inner PCP decoder T> m interacts with 
provers A and B, and the outer PCP decoder V out interacts with provers C and D. The composed 
PCP decoder V comp works as follows: On input (<1\ F ), V comp simulates V out to obtain the tuple 
(gout, <Pout, gout, /out)- Letting q out = (it. v) we picture this as an edge in the bipartite graph of the 
outer dPCP, and we label this edge with (g? ou t,3out, /out)- In its normal running V (mt generates 
queries q Qu t = (u,v) and queries C on u and D on v. It then checks that if out (C(u)) = 0 and 
9out(C(u)) = D(v) and if so it outputs f on t(C(u)). 
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However, the answer C(u) is too large for 'D C(imp , and we would like to use the inner PCP 
decoder V m to replace querying C directly, reducing the answer size at the cost of a few extra 
queries. For this purpose, the composed PCP decoder V comp now simulates the inner PCP decoder 
Pin on input (<p ou t, (gout, /out)) to generate the tuple (g in , <p in , gin, /in)- The composed PCP decoder 
Pcomp then queries the inner provers A. B on queries q- m = (w. z) to obtain the answers a = A(w) 
and /3 = B(z). It then performs the projection tests g m of the inner PCP decoder V m and produces 
its output fi n (a). These answers are then used to both perform the projection test of the outer PCP 
decoder as well as produce the required output of the outer PCP decoder. 

As usual in composition, we need to enforce consistency between the different invocations of 
V i n . The input for V m , namely (g; n . y m . g m . f m ), is generated using Pout's randomness, namely R 
and j. The provers A and B must be told this input because they need to know what they are 
supposed to prove. Thus A and B are actually aggregates of prover-pairs A(R, j), BUI. j) ranging 
over all possible R,j . There is a possibility that they could "cheat" by outputting a different 
answer for the same outer question, depending on R and j. In particular, think of two outer query 
pairs (u, v\) and (u,v 2 ) generated by two different random strings R\. j\ and Bi-.'j'i- We need to 
ensure that both invocations of V- m are consistent with the same answer C(u). 

We address this issue using the decoding feature of the inner PCP decoder V m . We replace 
the outer prover C by a prover C*, which we call the consistency prover. This prover is sup¬ 
posed to hold an encoding, via E- m , of the outer prover C. The composed PCP decoder T> comp ex¬ 
pects the inner PCP decoder V m to decode a random symbol in this encoding (i.e., in E m (C(u))). 
This decoded value is then checked against the consistency prover C*, which unlike the inner 
provers is not informed of the outer randomness R. In all, the queries of P comp are w. z. (u. j m ). v 
to A, B, C*, D respectively. 

This additional consistency query helps us get around the above mentioned issue at a small 
additional cost of r/; n in the soundness error, where r/ m is the agreement parameter of the encoding 
E- m (see Remark 2.4). 

It can be shown that this consistency query ensures that the distributional soundness error 
of the composed decoder is at most the sum of the distributional soundness errors of the outer 
and inner PCP decoders and the agreement parameter of the encoding E\ n . Previous soundness 
analyses using list-decoding soundness typically involved a Li n -fold multiplicative blowup in the 
soundness error <5 out of the outer PCP decoder (i.e., <5 comp > L- m ■ c) olll ) where L- m is the list-size of 
the inner PCP decoder. Distributional soundness has the advantage of getting rid of this Lj n -fold 
blowup at the cost an additional r/ in additive error. 

The above description easily generalizes to k > 2 by replacing B by Bp, ..., -Bfc in _i and D by 
D\,..., Dk out -i- 

As in the case of the definition of decodable PCPs, we find it sufficient to describe composition 
of algebraic dPCPs and not general dPCPs. 

Theorem 4.1 (Composition Theorem). Let ¥ be a finite field. Suppose that N out , A; n , r ou t, n n , s out , 
-Sin, n ( ,ut , fout , fin, Cult, Cn• Cut, hn £ 2A, Olid (f 0 ut, ^in, Pin £ [0, 1] 0T& Slich that 

• Alg-CktSAT has a k 0 ut-prover l out -answer decodable PCP V on t with respect to encoding E 0ut : 
F n ° ut -> F* out with randomness complexity r out , answer size s ou t, and distributional soundness error 
<5 out on inputs <!> of size N ou t , 

• Alg-CktSAT^ has a k[ n -prover l m -answer decodable PCP V m with respect to encoding E in : 
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F n i" —> F tin with randomness complexity r in , answer size s; n , and distributional soundness sound¬ 
ness error <5;,-, on inputs <p of size N- m 

• © 7Ji n © Ninr 

• l\n — ut. T loutr 

• the inner encoding E m has agreement parameter r/- m 

Then, Alg-CktSAT has a k out + k- m -prover l out -answer dPCP, denoted V comp = V out © V m , with respect 
to encoding E out on inputs $ of size N with 

• randomness complexity r out + r in + log 2 (h n ), 

• answer size Si n , and 

• distributional soundness error <5 out + <i in + r/ in . 

Furthermore, there exists a universal algorithm with black-box access to V out and V m that can perform the 
actions ofV comp (i.e. evaluating V comp (<3>, F ; R,j)). On inputs of size N, this algorithm rims in time N c 
for a universal constant c, zvith one call to V ou t on an input of size N and one call to V m on an input of size 

^OUt‘ 

Proof. We will follow the following notation to describe the composed decoder. 

Provers of V comp Suppose the inner PCP decoder V m interacts with provers A, B±,..., 1 

(here A is the large prover and Bfs are the projection provers), and the outer PCP decoder interacts 
with provers D kout _ 1 (here C is the large prover and Dfs are the projection provers). 

As mentioned in the informal description, the composed PCP decoder V comp simulates V out 
except that instead of querying C, uses the inner PCP decoder V m and an additional consis¬ 
tency prover C*. Thus, the provers for the composed PCP decoder T> C omp will be the following: 
A, B i,..., /i/, in _ |, C*. I)\..... Dk out - 1 ) the main prover being A and the projection provers being 
the rest. As mentioned in the outline, for each choice of the outer randomness i? 0 ut and index 
jout the inner PCP decoder V[ n is simulated on a different input. Hence the corresponding inner 
provers for the composed dPCP V comp (i.e.. A, B \,..., /f/, ni _ i) are explicitly given the specification 
of the outer randomness f? ou t and index j out as part of their queries. (Alternatively, one can think 
of A and B, as an aggregate of separate provers A(R out ,j 0 ut) and B t (R. outj .j out ) per R out , j ou t)- 

Randomness of V C omp The randomness of V comp comes in three parts: the randomness f? ou t of 
Rout, the randomness R\ u of V m and a random index j- m to perform the consistency test. Thus, 

f^comp — ( R<)\it • R\n • Jin ) • 

Decoded Index of V comp The index j C omp being decoded by V comp is passed as the index j out 
being decoded by T> 0 ut- 
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Indexing the answers of V com p Note that the number of answers l\ u of the inner PCP decoder 
V m is the sum of the number of answers l OVL t of the outer V ()Ul and the number of provers k ou t 
of outer Pout- Thus, f m is a list of / out + fc ou t functions. We will find it convenient to index the 
functions in /i n with {0} U ({out} x {0,1,..., Z 0 ut — 1}) U ({proj} x {1,..., k ou t — 1}), such that 
/in,(proj,i)' * = L • • • - &out — 1 / are the answers to be compared with the outer projection provers, 
f- m fl is intended for the consistency test, and /j n ,(ouU), * = 0 ,..., /: ont , — 1 , give the answers for the 
outer decoder. 

With these conventions in place, here is the description of the composed PCP decoder, V comp : 

T^comp(T > , F, R<,]\t . Rim jin)- 

• Input: ($,F) 

• Random input string: (R out , Rin, jin) 

• Index to be decoded: j ou t 

• Provers: II = (A, B u ..., B kin _!,C*, D t ,D kout _ i) 

1. Initial Computation: 

(a) [Simulating V out ] Run V ont ($, F; R out , j ou t) to obtain (q out , <p out , 5out, /out)- 

(b) [Simulating P in ] Run P in (<p out , (gout, /out) ; Rin, jin) to obtain (g in , <p in , g in , / in ). 

2. Queries: Let q out = (u, vi,..., v kout -i) and let q in = (w, zi ,..., z fcin _i). 

(a) Send query (F ou t, Jout, w) to prover A to obtain answer a = A(R out ,j out ,w ). 

(b) For i = 1 ,..., ki n -i, send query (R ou t, jout, z % ) to prover II, to obtain answer B t = 

Bi ( Rout , Jout > Zi ). 

(c) Send query (u,ji n ) to prover C* to obtain answer 7 = C*(u,j m ). 

(d) For i = 1..., k out — 1, send query v t to prover I), to obtain answer Q = Di{vi). 

3. Checks: 

(a) [Inner local predicate] Check that (p- m (a) = 1. 

(b) [Inner projection tests] For i = 1 ,..., ki n ~i, check that (j niJ (a) = Bi- 

(c) [Consistency test] Check that fi n ,o (a) = 7 . 

(d) [Outer projection tests] For i = 1,..., k (m t- 1 , check that /i n) (p roj) j) (ct) = Q- 

4. Output: If all the checks in the above step pass, then return /i n: ( out) .) (a) else return _L. 

The claims about Fcomp's parameters (randomness complexity, answer size, number of provers, 

number of answers) except completeness and soundness error can be verified by inspection. Thus, 
we only need to check completeness and soundness. 

Completeness Let x e SAT (3>). By the completeness of outer V out , there exist provers II out = 

(C, Di,..., D kout _ 1 ), such that for all (i? ou t, Jout) we have 

T’out (^* 1 T 1 ; f?out; Jout) = ^ Eout ( x )j out > -^1 ( x ) j • • •) T) out (x)^ . 

Fix any particular outer random string R out and index j out . Let V out (T. F: R out , j out ) = (q out , <p out , g out , / ou t)• 
Since the outer decoder V ont does not reject, we must have that U(R out j out ) '■= C(u ) satisfies y 0 ui • In 
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other words, U(R out j out ) E SAT (<p out ). Now, by the completeness of the inner V in , we have that for 
these (Rout, jout) there exist provers = {A {Ronujoat) , B {Rout Jout)> i,..., B {Roat Jout) , fci „_i) 

such that for all (Am, jin) we have 

n in / \ 

^in ° Ut J ° Ut) (^out, (fi'out, font) ! Rin, jin) = ^in (?/(R 0 ut,iout)) j in ’ Sout {y(R out Jout)) ’ font {y(R ou t Jout)) J ' 

We are now ready to define the provers 

n = (A, B\,... ,B k . n _i,C*,Di,... ,D kont _i) 

for the composed decoder V comp . As the name suggests, the projection provers Di,i = 1,..., A 0 ut. — 
1 are exactly the same as the outer projection provers in n out . The consistency prover C* is defined 
by encoding C(u ) separately for each u as 

C* (u,j in ) :=E in (C(u)) jin . 

The projection provers B i} i = 1,..., k in - 1 are defined as II, (A ou t, jout, a) := B (R out ,j out ),i (a)- 
Finally, the large prover A is defined as A (R ou t, jout,'«') := ^(R out ,j out )(w). It is easy to check that 
according to this definition of II, for each ((A 0 ut, Rin, jin ) • jout) it holds that 

®comp (^> R, (-^out) Rin) Jin) > Jout) = ^Rout ( x )j out ’ ( X ) ) ■ ■ • ) RJout O^)) • 

This proves the completeness of R CO mp- □ 


Distributional Soundness of R CO mp We prove the following statement about the distributional 
soundness of R comp . 

Lemma 4.2. Suppose the outer PCP decoder V out has distributional soundness error <5 out with respect 
to encoding E out , and the inner PCP decoder V- m has distributional soundness error 5; n with respect to 
encoding E in , and suppose E- m has agreement parameter p m (see Remark 2.4). Then, the composed PCP 
decoder V comp = P ou t © Rin has distributional soundness error <f C omp < 5 ou t + 5m + Pin with respect to 
encoding E out . 

Proof. Suppose V comp on input (<I>. F) interacts with provers 

n = (A, Bi ,..., Rfc in - 1 , C*, Di,..., Dfc out - 1 ) ■ 


To prove soundness of R CO mp, we need to construct for each composed random string R comp := 
(Rout, Rin) jin)/ functions x (Rcomp) and II (Rcomp) such that II (R CO mp) is either 1 or a valid proof 
for the statement x (R comp ) E SAT (<1>), and for every j out we have 


Pr 

■Rcomp 


Rcomp (^) R) Rcomp) jout) — T Or H|g comp 


n(R, 


comp J 


Qc omp 


A 1 (5 0 ut T 5j n T Vin), 


where g C omp is the query vector generated by D comp . 


The construction of x (R CO mp) and II (R CO mp) relies on the soundness properties of R ou t and Rj n . We 
first locally-decode C* to obtain a distribution over outer provers C. We then use the distributional 
soundness of R ou t to obtain an idealized outer proof (C. I),). We then use the soundness of R; n to 
obtain idealized inner proofs (A, Bi). 
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Outer main prover Cj in : For each j m , we define an outer main prover Cj in using the consistency 
prover C* as follows. Let t = r/- m / 2 be the agreement parameter of E m , as in Remark 2.4. For 
each query u := g ou t,o to the outer main prover, G' ?iii (u) is defined to be the ji n -th entry of the 
r-local decoding of C* (u. •) as in Definition 2.2 if well-defined and X otherwise. 

Idealized outer pairs x°?f (Rout) and IT)’)) (-R out ): For each j- m we have an outer proof 

n^ = (C jin ,D 1 ,...,D kout _ 1 ). 

Note that only the C provers are different in the various outer provers Fl° ut as we range 
over ji n . From the soundness of V out for every IT -'' 1 there is an idealized pair X ) 1 ) 1 (Rout.) and 

Flj’f (i?out) = (d,Di,..., Dk out - 1) 4 that "explain" its success. 

Idealized inner pairs y'" R j ) (R- m ) and II)), o (R- m ): For every outer randomness R and index j let 

u Trj) := ( A ( R >J >0 > Bl ( k R •)>•••> B h n -i (. R,j , •)) 

be the relevant part of the proof for V m . 

Let (q, tp, g, f) = V oat (4>, F: R, j). When R ou t = R and j out = j, the composed decoder V comp 
simulates running V\ u with input (y. (g. f ); -Rm, Jin) and with the proof ITj 1 ^.,. 

For each FlJjjthe soundness of Pi n guarantees idealized prover pairs y' ( " R R and IIJ'^ j ;i 
( functions of F?; n ) that "explain" its success. 

We are ready to define the idealized (x, II) pairs for the composed decoder XLomp- 

Idealized composed pairs x (R c om p) and II (R CO m P ): Recall that f? com p is short for (R out , Rm, jin)- 
Define x (R c om p) := F”'))' (f? ou t). We then set II (f? com p) as follows: If IT ) 1 ) 1 (Rout) is successful, 
in particular Cj in (u ) = C(u), set II (i? com p) to be the set of provers 
(A Bi, ..., B k . n _ 1 ,C*,D 1 , D fcout _i) defined next. 

• The outer projection provers Di are defined to be the same as in 11) 1 ) 1 (f? ou t)- 

• Let C be the main prover in IT ) 1 ) 1 (F2 0 ut)- We define C* as follows: 

C* (u,j) :=E in ( C(u )) 

• For any pair (R, j ) where R <E {0, l} r ° ut and j £ [tout]/ we define A (R, j, •) and Bi (R, j, •) 

(for i = 1,..., k- m — 1) as follows. Denote (q , tp, g , /) = V ou t (<F, F-,R,j) and suppose 
q = (u,v 1 ,... Wfcout-i)- If y'(ii. J )(R'm) = C(u ) and also (R in ) is successful, we set 

A (R,, j. •) and the provers Bi (R. j. •) to be the main prover and projection provers in 
IIA j) ( Rm) respectively. 

4 The proofs (c, Di,..., Dk oat -t^ depend on jj n and R au t so more formally could be written as 
(Am (-Rout), A in ,i(Rout), ■ • ■, Am^out-i(Rout) Lbut we will drop the indices for ease of readability. 
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Otherwise, if y'/ 1 R ^(R.m) / C(u) or IT^, ^ (R; n ) is not successful, we define A ( R,j , ■) 
and Bi (R. j. •) by letting them be some valid proofs for the statement C(u) £ SAT (tp) 
(Note that C\u ) satisfies ip since II‘™ t (R 0ut ) is successful). 

If either 13^ (R 0ut ) is not successful or any of the intermediate objects in the above definition 
are _L, then we set II (R com p) to _L. 


It remains to show that the pair x (R c om p) and II (R CO m P ) has the desired properties. It follows 
by inspection of the definition of II (R CO mp) that whenever it is not _L, it is a valid proof of the 
statement x (R c om p) £ SAT (4>) and agrees with the local view of II on input (<&, F\ R CO mp) /out)- 
So it remains to show that for every j ontr 


Pr 


-Rc, 


II (Rcomp) — -L and R CO mp (41, F, Rcomp) /out) 7^ -t. 


We partition the above event intro three parts according to the highest indexed condition among 
the following three conditions that does not hold — one of them must not hold for II (R CO mp) to be 
equal to _L. 


1. II^ (I? ou t) is successful, in particular C' ?iii (u) = C(u). 

2 - 

3 - W.,,,.I ,R '"> is successful. 

We separately bound the probability of each event in this partition. 

• We bound the probability that Condition 3 does not hold, namely that IT^ t . ^ (R in ) is not 

successful, and yet P comp does not reject. If Rcomp doesn't reject then in particular checks 

n in 

Check 3a and Check 3b pass, which means that T>F R ° ut,Jout) (<p Qut , (g out , f out ) ; R in , / in ) / _L. 

But the soundness of V[ n implies that the probability over the choice of Rj n that this occurs 
and yet Ilj. 1 ^ t . ^ (Ri n ) is not successful is bounded by <5 m . 

• Now we bound the probability that Condition 3 holds. Condition 2 does not hold, and 
yet Rcomp does not reject. When Condition 3 holds, the output of the V m simulation for 

the encoding is E ai ( y' ( n R ^ (Ri n )J • It is thus enough to bound the probability that 

WRoutdont) W + ^(“) 311(1 y et E “ (^outdout) (^)) • = ^ CheCl< 3C P 3SSeS - 

Since by definition Cj in (u) is the r-local decoding of C* (u. •) at position j- m , Claim 2.3 and 
Remark 2.4 imply that the probability of this event over the choice of is bounded by the 
agreement parameter rj m . 


• It remains to bound the probability that Conditions 3 and 2 hold but Condition 1 does 
not, and yet V comp does not reject. When Condition 2 and 3 hold it means that C (u) = 
y'" R ( . | . (Ri n ) £ SAT (poui) and the output of the simulated V m computed by Z) comp is 


/in [A (Rout;/out; tC)) 





) /out 
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If Pcomp does not reject it means that the values of g ont yC(u)J match the ones obtained from 
the outer projection provers, to which it is compared in Check 3d. But these are also the 
values used by V out when it is run on input (4>, F; R 0 ut, jout) with the proof 11 °“*, which 

j~jout 

means that V Q f™ (<f>, F; R ou t, Jout) f -L. But the probability over the choice of R 0 ut that this 
happens while Condition 1 fails is bounded by <5 out , the distributional soundness error of 

Vout. 

This proves the distributional soundness of V comp . 

□ 

This completes the proof of the Composition Theorem 4.1. □ 


5 Proof of Main Theorem 

Theorem 5.1 (Main Construct). Every language L in NP has a 0(lg lg IV/ lg lg lg N)-prover projective 
PCP with the following parameters. On input a Boolean predicate/circuit <f> of size N, the PCP has 

• randomness complexity OjlgN), 

• query complexity 0(lg lg IV/ lg lg lg N), 

• answer size 0(lg N/poly lg lg N), 

• perfect completeness, and 

• soundness error _/V 1 /( 1 g 1 g Ar ) ntl) . 

The PCP with inverse polynomial soundness error stated in Main Theorem 1.7 is obtained by 
sequentially repeating the above PCP poly(lg lg N) times in a randomness efficient manner. 

5.1 Building Blocks 

The two building blocks, we need for our construction, are two decodable PCP based on the 
Reed-Muller code and the Hadamard code respectively. The constructions of both these objects is 
standard given the requirements of the dPCP. These PCPs are based on two encodings the low- 
degree encoding LDE and the quadratic Hadamard encoding QH respectively. The definition of 
these codes is given in the next section (§ 6 ). For the purpose of this section, it suffices that these 
are error correcting codes with very good distance. 

Theorem 5.2 (Reed-Muller based dPCP). For any finite field F, and parameter h such that 1 < h < 
|F| 01 and any ( > 0, there is a 2-prover £+ 1-answer decodable PCP V with respect to the encoding LDEp/j 
for the language Alg-CktSATu- with the following parameters: On inputs (i) a predicate <f> : ¥ n —> {0,1} 
and (ii) functions F \,..., : F n —» F given by arithmetic circuits over F whose total size is N, the dPCP 

V has (let m = log N/ log h), 

• randomness complexity OjlogN + ?nlog |F|) = 0{m log |F|), 

• answer size s, s' = 0(m(m + £)), 
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• and distributional soundness error l/lF) 0,1 . 

Theorem 5.3 (Hadamard based dPCP). For any finite field F, and any l > 0, there is a 2-prover 1 + 1- 
anszver decodable PCP T>qh,f w ^h respect to the encoding QH ¥ for the language Alg-CktSATf with the 
following parameters: On inputs (i) a predicate $ : F n —> {0,1} and (ii) functions F\,..., Fe : F n —> F 
given by arithmetic circuits over F whose total size is A, the dPCP Pqh.f has 

• randomness complexity 0(N 2 log |F|), 

• answer size s, s' = 0(1), 

• perfect completeness, and 

• distributional soundness error < l/|F| ai . 

These theorems are proved in Section 6 . 

5.2 Putting it together (Proof of Theorem 5.1) 

By NP-completeness of CktSAT it suffices to prove Theorem 5.1 for CktSAT. Let K l> be an instance 
of CktSAT and let A denote its size. Let e = 20 lg lg lg A/9 lg lg A be a parameter 5 . Note that 
(lg N) £ = (lg lg A) 20 / 9 . Let M = 2( lgAr ) 1_e = jvV( lglgA 0 2O/9 . choose a prime number p 6 (M, 2M) 6 
and let F = GF(p ) be the finite field of size p, which we fix for the rest of the proof. We may 
assume wlog. that the predicate ’L has only AND and NOT gates. Given this, we can arithmetize 
$ to obtain an arithmetic circuit <f> over F by replacing AND gates by multiplication gates and 
NOT gates by 1 — x gates. Thus, we can view the A-sized predicate $ as an A-sized arithmetic 
circuit over the field F. 

We construct a PCP for 'L with the required parameters by constructing a dPCP for $ with 
respect to the encoding LDEf ,^ 0 for some suitable choice of ho. This dPCP is in turn constructed 
by composing a sequence of dPCPs each with smaller and smaller answer size. Each dPCP in the 
sequence will be obtained by composing the prior dPCP (used as an outer dPCP) with an adequate 
inner dPCP. The outermost dPCP as well as the inner dPCP in all but the last step of composition 
will be obtained from Theorem 5.2 by various instantiations of the parameter h. The innermost 
dPCP used in the final stage of the composition will be the dPCP obtained from Theorem 5.3. 

Stage I: Let no = A and ho = |F| ai = 2 °- 1 ( lgiV ) 1 e = A ai /( lglgAr ) 20/9 . For this choice of no, ho 
and F and Iq = 0, let 'D u,> := D 0 be the dPCP obtained from Theorem 5.2. This will serve as 
our outermost dPCP. Let us recall the parameters of this dPCP. Observe that for this setting mo = 
l°g/i 0 n o = lg A/ lg /to = 10(lg lg A) 20 / 9 . is a 2-prover decodable PCP with respect to the 
encoding LDEp^o f° r the language Alg-CktSATf with the following parameters: On inputs 
$ of size A over F, has randomness complexity Rq = c ■ m-olg |F| = 10c IgA, answer size 
so = 2(moho) 2 < 2°- 3 ( lgAr ) 1 e = A°- 3 /( lglgA 0 2O/J and distributional soundness error l/|F| ai . 

5 In the construction, setting e = 20 lg lg lg A/9 lg lg A will prove the poly lg lg A-query PCP with inverse polynomi- 
ally soundness error (as stated in the main theorem). It is to be noted that setting e to a constant in (0,1) will recover 
the DFKRS PCP. 

6 Since the procedure is allowed to run in polynomial time in A, it has enough time to examine every number in the 

range (M, 2 M) and check if it is prime or not. 
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Let e' = e/10 = 2 lg lg lg A/9 lg lg A. Let i* be the smallest integer such that 1 — £ — ie'< 9e/80. 

Note that i* = 0(1 /e) = 0(lglg A/ lglglg A). For i = 1,..., i*, let V l be the dPCP obtained by in¬ 
stantiating the dPCP in Theorem 5.2 with parameters hi = 2^ g ' v )' = A'Ask N ) 20/9(1+l/10) and 

li = 2i. We will run dPCPP* on inputs of instance size rii = 2 3 ( lgiV ) 1 £ u 1! ~ = jV 3 /( lglgAr ) 20/9 tl+<1 1,/10> . 
Thus, nA = lgnj/lg/ij = 3(lg A) £/ = 3(lglg A) 2 / 9 . Hence, V t is a (2 i + l)-answer 2-prover dPCP 
that on inputs of instance size n, has randomness complexity R, = cm, lg |F| = 3c(lg A) 1_£+£ = 

3clg A/(lglg A) 2 , answer size s* = 2(rriihi) 2 < 2 : ^ lg A ' L ’ s = jV 3 /( lglg A r ) 20/9 (1+8/10) and distribu¬ 
tional soundness error 5i = 1/|F| 0,1 . 

Observe that our setting of parameters satisfy Sj_i < rn and l l+ \ + 1 = 2(i +1) +1 = (Zj +1) + 2. 

So the answer size of the predicates produced by dPCP T> t are valid input instances for dPCP 
T>i + 1 , for i = (),..., i* — 1. Hence, we can compose them with each other. Consider the dPCPs T>^> 
defined as follows: 

X>W ;= p(i-i )®V U z = l,..., i*. 

Also note that the code LDE^/,. has block length |F| mi and distance (1 — 0(rriihi)/\W\) > 1 — 
l/-^/jF|. Thus, the agreement parameter //, is at least 1/|F| l/6 . 

Let V A := be the final dPCP obtained as above. Observe that it is a 2i* = 0( 1/e) = 

0 (lg lg A/ lg lg lg A)-prover dPCP with respect to the encoding LDEif./ 1o for the language Alg-CktSATr 
with the following parameters: On inputs <3? of size A over F, the dPCP V i 1! has randomness com¬ 
plexity distributional soundness error 6 (r> and answer size (which are calculated below). 

i* 

R (I) = Rq + (Rj + log(blocklength(LDE fa,))) 

i=\ 

i* 

= 10clgA + ^ (cm; lg |F| TYii lg |F|) 

1=1 

IgA 

= 10clgA + V 3(c + 1 )——-——2 
“ (IglgA) 2 

= 1 lc lg A [ since i* < lg lg A]. 

= Si* 

= 2 3(lg 

< 2 3(lgA r ) 9£/8 ° 

= 2 3(lgIgJV)V 4 _ 
i* 

s {1) = s 0 + ^2(di + m) 

i =1 

= (i* + !) • (jFjlu + jip^Te) 

1 
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Stage II: We now compose the dPCP D' :J> constructed in Stage I with another dPCP obtained 
from Theorem 5.2 as follows. Let Vjj be the dPCP obtained from Theorem 5.2 by setting h = 2 
and l = 2i*. This dPCP will run on inputs of instance size njj > = 2 3 ( 1 s Ar ) 9e/MI = 2 3 ( lglgAr ) 1/4 . 

Thus, mn = ^gnu/lgh = 3(lgA) 9e / 80 = 3(lglg A) 1 / 4 . Thus, Dn is a 2 -query (2 i* + l)-answer 
dPCP on inputs of instance size njj, randomness Rn = c • m//log|F| = 3c(lg W) 1_71e / 80 = 
3clgA/(lglgA) 71 / 36 , answer size sn = 2(?«///i//) 2 < 0((lg jV) 9e / 40 ) = 0((lglgA) 1 / 2 ) and dis¬ 
tributional soundness error Sn = 1/|F| 01 . Let D (ll: be the dPCP obtained by composing dPCP 
p( 7 ) obtained in the previous stage with dPCP Dn, be., D^ 11 ^ = D^ © Du. The encoding LDE F ,h 
hasblocklength |F| m// and distance l — 0(muh)/\¥\ > 1 — 2/|F|. Hence, its agreement parameter is 
at least 1 /|F| 4 / 6 . Thus, dPCP D^ 11 ' 1 is a 2 (i* + l)-prover dPCP with respect to the encoding LDEf^q 
for the language Alg-CktSAT f with the following parameters: On inputs of size A over F, the 
dPCP V 1 ' 11 ^ has randomness complexity R^- 11 ^ = R^- 1 ' 1 + Rn + mn lg |F| = 0(lg A), distributional 
soundness error <5( 77 ) = < 5 ( 7 ) + 5n + Vn < pyros and answer size s^ 77 ) = sn = 0(V lg IgA'). 

Stage III: We now compose dPCP D u with the Hadamard based dPCP constructed in Theo¬ 
rem 5.3 to obtain our final dPCP. Let Dm be the Hadamard based dPCP constructed in The¬ 
orem 5.3 with l = 2(i* + 1), i.e.. Dm = T > QH,F, 2 (j*+i)- Dm will be run on instances of size 
nni = 0(\/lglgiV). Thus, Dm is a 2-prover (2 i* + 3)-answer dPCP with respect to the encoding 
QH f for the language Alg-CktSAT with the following parameters: on inputs of instance size 
nm, it has randomness complexity Rm = 0{n 2 ni lg |F|) = 0(lgN), answer size sm = 0(i*) 
and distributional soundness error Sm = 1/|F| 01 . Furthermore, the blocklength of the encoding 
is |F| 0 ( n n/) and has agreement parameter l/^/pF[. The final dPCP D^ 111 ^ is given by composing 
pCL with Dm, be., D^ 111 ^ = @ Dm. Note that s ^ < nm- Thus, the final dPCP LT m ) j s 

a 2 (i* + 2 )-prover dPCP with respect to the encoding LDE f ,/i 0 for the language Alg-CktSAT f 
with the following parameters: On inputs $ of size N over F, the dPCP D^ ni > has random¬ 
ness complexity R^ 111 ^ = iW 7 ) + Rm + 0(n 2 n lg\¥\) = O(lgiV), distributional soundness error 
(i^ 777 ) = <f( 77 ) + Sm + Vhi < | F io.o 5 an d answer size s^ 111 ' 1 = sm = 0(i*) = 0(l/e). 

Summarizing, we have constructed a 0(lg lg n/ lg lg lg n)-prover dPCP V 11 rr ) for A I .G-C KTS AT p 
with respect to the encoding LDEp ^p with the following parameters: on inputs $ of size N, 
D (nr> has randomness complexity O(lgiV), answer size 0(lglg A/lglglg N) and and distribu¬ 
tional soundness error A r|/ P o| y lglg ,v . This dPCP implies a PCP for CktSAT with parameters as 
stated in Theorem 5.1. Note that the answer size is larger by a factor of log |F| = lg A/poly lg lg N 
since the size of the output predicate is measured in terms of its Boolean circuit complexity as 
opposed to arithmetic complexity. □ 

5.3 Optimality of our parameter choices 

In this section, we show the optimality of the parameters (upto constants) obtained in our Theo¬ 
rem 5.1 using the Reed-Muller based dPCP (Theorem 5.2) and the Hadamard based (Theorem 5.3) 
dPCP as building blocks in our composition paradigm. Of course, if one had an improved build¬ 
ing block, then one can potentially improve on the construction. 

Let N be the size of the instance and let S be the soundness error of the construction. Define 
parameter e as follows: log(l/e)) = (log A ") 1 W Consider any sequence of compositions of the 
Reed-Muller based dPCP and Hadamard based dPCP. Observe that the size of the Hadamard 
based dPCP is exponential in its input instance size. Hence, the first sequence of composition steps 
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must involve only the Reed-Muller based dPCP wherein the size of the instance is sufficiently 
reduced to allow for composition with the Hadamard based dPCP 

We first argue that one needs to perform at least 0(1/e) steps of composition of the Reed- 
Muller based dPCP so that the instance size is sufficiently small to apply the Hadamard based 
dPCP. Suppose we perform t steps of composition of the Reed-Muller based dPCP wherein at the 
i-th step the instance size drops from W-i to A/ (here. No = N). Since the error at each step 
is at most 6, the field size used in each stage of the Reed-Muller based dPCP must be at least 
1/6 = 2 log ;V ' . To maintain polynomial size of the overall construction, each of the Reed-Muller 

based dPCPs used in the t steps of composition must satisfy F,;| m ' = N 0i 11 where F, and rn, are 
the field and dimension used in the construction of the Reed-Muller based dPCP used in the i-th 
stage of the composition. Hence, m* < 0((log N) £ ). Thus, the reduction in size in the i-th step 
is at most N t > Ay// 1 ’' = A r Vj log ^ , which implies inductively that the instance size after t steps 
of composition of the Reed-Muller based dPCP is at least 2 log ;V E . Hence, to obtain a size that 
allows for composition with the Hadamard-based dPCP we must have at least t = 0(1/e) steps of 
composition. 

We now account for the total randomness used in these t = 0(l/e) steps of composition. Since 
the error in each step is at most 6, the randomness uses in each step must be at least log(l/<5) = 
(logAf) 1-e . Hence, the total randomness used in these t steps is at least t ■ log(l/<5) = 0(1/e) ■ 
(log A T ) 1 ~ e . Since the size of the entire construction is at most polynomial we must have that 
1/e • (log/V) 1-e = 0(\og N). Solving for e 7 , we obtain that e > log log log N/ log log N. Hence, 
the best soundness error obtained by a sequence of composition involving the Reed-Muller and 
Hadamard based dPCPs is at least 6 = 2 <]og = N 1 /P ol >' log log A proving optimality of the 
Theorem 5.1 construction. 

6 Construction of specific dPCPs 

In this section, we construct our two building blocks; the Hadamard-based dPCP (Theorem 5.3) 
and the Reed-Muller-based dPCP (Theorem 5.2). Our construction proceeds by adapting previous 
constructions of these objects which guaranteed only list-decoding soundness. We obtain distribu¬ 
tional soundness by observing that if the dPCP satisfies list-decoding soundness and the encoding 
has very good distance (nearly 1), then the dPCP satisfies distributional soundness. 

6.1 Preliminaries 

Let F be a finite field. 

Definition 6.1 (Hadamard). The Hadamard encoding of a string a € F m is a function h : F m — > F 
defined by 

Vo 6 F m , h(a) = ouch. 

i 

Definition 6.2 (Quadratic Hadamard). The Quadratic Hadamard encoding (QH encoding for short) of 

a string a e F m , denoted QH a , is defined to be the Hadamard encoding of the string w = a o b G ]F m + m2 
2 

inhere b e F m “ is defined by b im+ j = aiajfor all 1 < i,j , < m (i.e. b = a® a). 

7 l/e ■ (log/V) 1-e = O(logiV) implies that 1/e < 0((logiV) £ or equivalently 1/e ■ log(l/e) < O(loglogiV). This 
implies that e > log log log N/ log log N. 
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Let £j E jpm+m 2 p e un q vector with 1 on the /th coordinate and zeros elsewhere. Observe 
that if h = QH a is the quadratic functions encoding of a, then for each 1 < i.j < rn, 

h[sf) — di and ^.(^i-m-t-j) — didj. 

Let H C ¥ and denote h = \H\. Fix an arbitrary 1-1 mapping H E7 [h\ := {0,1,..., h — 1}. 
We refer to elements in H as integers in [h] relying on this mapping. For any m > 0 we map 

x = (xi,..., x m ) E H m to x = x\ + x 2 h + ... + x m h m ~ l + 1 E [h m ]. 

Definition 6.3 (Low Degree Extension). Given a string a E ¥ n , we define its Low Degree Extension 
with respect to H CF, denoted LDE a , as follows. Let m be the smallest integer such that h m > n. Let 
f : F m — > ¥ be the unique function whose degree in each variable is at most h, defined on H m by 

Mx E H m fix) = { a * ^ e 

’ \ 0 n < x < h m . 


and extend f to ¥ m by interpolation, and set LDE a = /. 

Claim 6.4. Let a E ¥ hmi , and let b E V hm2 ~ hmi , so that aobe ¥ hm2 . If 9l = LDE a and g 2 
then 


Vxi,... ,x m G ¥ m , gi(xi,. .. ,x mi ) = 52(^1, • • ■ ,x mi ,0). 
Proof For each (xi,..., x m ) E //"' we have 


5 i(xi,... ,x m ) = ax = (d o b)x = 02 (zi,... ,x m , 0 ). 


LDE ao i, 


Thus, 01 and g 2 coincide for all points in H m . As a function of xi,..., x m , gi and 02 ( 2 : 1 ,..., x m , 0) 
have degree at most h in each variable, so they must coincide for all points in F m too. □ 


Definition 6.5 (Curve). Given k < |F| and a sequence ofk + 1 points r = (zo,..., Zk) in F m , define 

curve T : F —> F m 


to be the polynomial function of degree at most k which satisfies curve T (i) = Zifor i = 0,..., k. 


Definition 6.6 (Manifold). Given r = (z\,...,zk) G F m , and three points x\,x 2 ,x 3 G F m define 
n fzi,...,z k ;xi,x 2 ,x 3 '■ IF 4 ¥ m to be the following degree k + l function 

— t 0 • CUVVe, X \,zi,...,Zk{t\) + t 2 X 2 + £3X3. 

Observe that y Z i,...,z h ;xi,x 2 ,x 3 contains the points z±,... ,zt and xi, X2,X3. 

We now state a low degree test, which has appeared in several places in the literature [RS97, 
DFK 1 11 , MR10]. First, a little notation. Supposed that Q : ¥ m —> F is a function of degree < d, 
and 'Yz 1 ,...,z k ,x 1 ,x 2 ,x 3 {to, h,t 2 ,t 3 ) = t 0 ■ curve XliZlj ... jZk (ti) + t 2 x 2 + t 3 x 3 is a manifold in F m of degree 
at most k + 1. Then the function Q o 7 : F 4 — > F has degree at most d(k + 1) and can be specified 
by coefficients. Given a manifold 7 and a function M (7) : F 4 —> F, we denote for each 

x G Im{ 7) 

M(7)[x] := M(y)(ti, ..., 14 ) for ti,..., such that j(ti ,..., tf) = x. 

The following lemma appears in [MR10, Lemma 4.4, Section 10.2 (in appendix)] and a similar 
lemma can be found in [HarlO, Lecture 9]. 
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Lemma 6.7 (Low Degree Test - Manifold vs. Point). Let m, k, d > 0, let 5 = ( mkd/ IF)) 1 / 8 , and let 
z\,... ,Zk € F m be fixed. Let Q : F m — > F be an arbitrary function, supposedly of degree < d. There 
exists a list of L < 2/5 degree d functions Qi,... ,Ql ■ F m -» F such that the following holds. Let T be a 
collection of manifolds, 

r = {'yzi,...,Zk,xx,X2,X3(t(h tl, t2, ^ 3 ) = to ■ curve xi ,zx,...,z k {t\) + t 2 X 2 + ^ x ^\ X \,X 2 ,X 3 

one per choice of x 1 ,^ 2 , a; 3 G F m . Let M : T —>■ f( 1 4 " ^ specify for each 7 the coefficients of a degree- 
d(k + 1 ) function supposedly equal to Q o 7 : F 4 -» F. Then, 


Pr \Q(z) = M(j)[z] and Q(z) 0 {Qi{z),.. .,Q L (z)}] < 6. 

z,^3z 

Finally, we state the following lemma, which gives a probabilistic verifier that inputs a predi¬ 
cate : F n —> {0,1} and a list of functions F\,..., Fg : F n —> F, and checks that (a, b ) are such that 
<F(a) = 1 and bi = Ffa) for each i = 1,..., i (b = F(a ) for short). 

Lemma 6.8 (Initial Verifier). Given a predicate <f> : F n —> {0,1} and functions F)..... I 7 : F n —> F 
zvhose total circuit complexity is N, there is a randomized verifier Vo that uses 0(log |F| + log N ) random 
bits and generates a quadratic polynomial p : F m —> F on m = 0(N ) variables such that, given access to a 
proof TT = aobos(z F m , 

• If <F(a) = 1 and Ff a) = bifor each i = 1,... then there is a unique string s = s(a, b) such that 

Pr \p(a,b,s) = 0] = 1. 

0 


• If either «I>(a) = 0 or bi Fi(a) for some 1 < i <£, or s s(a, b), then 


Pr [p(a, b , s) = 0] < 

P~Vo 


2 

M' 


This verifier would be ideal except for one drawback: in order to evaluate p(tt) it makes an 
unbounded number of queries to the proof it. 

Proof, (sketch) The proof of this lemma is standard: s will specify the values of all of the inter¬ 
mediate gates of the circuit computing $ as well as the circuits computing T),.... T). The validity 
of each intermediate computation step can be checked by a quadratic or linear equation over 
the entries in s. The verifier Vq will use its randomness to generate a (pseudo)random sum of 
these equations (using an error correcting code, details are omitted). This can be expressed as a 
quadratic polynomial over the set of new variables. □ 


6.2 Hadamard based dPCP 

In this section we construct a dPCP based on the Hadamard encoding, given formally in the fol¬ 
lowing lemma. 

Theorem 5.3 (Restated) (Hadamard based dPCP) For any finite field F, and any £ > 0, there is a 2- 
prover £+l-ansiver decodable PCP T>qh,f with respect to the encoding QH F for the language Alg-CktSAT f 
zvith the follozving parameters: On inputs (i) a predicate <F : F n —> {0,1} and (ii) functions T)..... I 7 : 
F n —> F given by arithmetic circuits over F zvhose total size is N, the dPCP T>qh,f 
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• randomness complexity 0(N 2 log |F|), 

• answer size s, s' = 0(£), 

• perfect completeness, and 

• distributional soundness error < l/|IF| ai . 


We define the verifier for Theorem 5.3. 


Decoder Protocol On input <3?, F \,..., Fg; j, r, let Vo be the verifier from Lemma 6 . 8 , and let n £ 
F m be the proof that Vo expects. Our decoder V expects the B prover to hold the QH encoding 
of 7 r and the A prover is expected to give restrictions of B to specified subspaces. It is known 
that with 0(1) queries into B the decoder could check that B is indeed a QH encoding of a valid 
proof 7T, as well as decode any quadratic function of n. The A prover is used to simulate this while 
making only one query to A and one to B. This is done by computing several query points for the 
former test, and then taking a random subspace S containing these points as well as a couple of 
uniformly random ones. 

The low degree test (see Lemma 6.11 below) guarantees that if A's answer on the subspace 
S is consistent with B's answer on a random point in S, then B is linear (in other words, it is a 
Hadamard encoding of some string). The decoder will also perform some other tests on values in 
S which ensure that moreover B is a valid QH encoding of a valid ir. 


1. Computing the query points. 


(a) Choose /3 ,7 £ W" uniformly at random, and define u\, 112 , '«;s £ F m+m2 as follows: 

m m mm 

^1 = PiEi, U2 = y^ j 7 i£i, U3 = EE fii'yi 1 E-ini+i 1 ■ 

i =1 i =1 i =1 i '=1 


(b) 


(c) 


(These are points for the multiplication test: if we already know that B is a Hadamard 
encoding of some string, then this test will ensure it is moreover a QH encoding. ) 

Draw a random quadratic polynomial p(ti ,..., t m ) = «o + Yli ajjdjQ from 

the distribution of Vo (from Lemma 6 . 8 ). To check that p(ir) = 0 we define z £ F m2 (for 
m 2 = m + m 2 ) by 

m mm 


Z = 


2 ai£i + S S 




2=1 2=1 2 /= l 

(If B were equal to QH n for some string 7 r then B(z ) + ao = p( tt) so the value of B(z) 
could be used to check that p( tt) = 0 ). 

For each i = 1..... 6 let o, = e, +n . Let Of + \ be the point in F ma corresponding to 
j = (<5i,..., S n+n 2 ) £ F n+n . (We are using here the fact that 7 r = a o b o s so the QF 
encoding of 7 r contains in it the QF encoding of a. Explicitly, set 


n n n 

°l +1 = SiCi + EE 

i=l i =1 i '=1 
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(These are the points to be output by the decoder.) 

2. Choose xi, x 2 , x 3 e F m2 uniformly at random, consider the (l + 8 )-dimensional linear sub¬ 
space 

S = span(xi,x 2 ,x 3 , ui,u 2 ,u 3 , z, oi,...,o w ) CF™ 2 . 

We assume there is a canonical mapping that maps each subspace S' to a particular basis 
vs = {v 1 ■ • • •, t ! £+ 8 } C ¥ r "' 2 for S and send it to the A prover and let A(v~s) G F £+8 be the 
prover's answer. The answer specifies a linear function A$ : S —> F defined by 

e+8 

Vfi,.. .,t e+8 <E ¥, A s ( tiVi) := ■ A(v~s)i 

i i=l 

3. Send xi to the B prover and let B(x 1 ) be its answer. 

4. Reject unless 

(a) As{x\) = B(xi), and 

(b) A s (z) + no = 0. 

(c) A s (ui)A s (u 2 ) = A s (u 3 ), and 

5. Output A s ( 01 ),..., A s (oi). 

The decoding PCP will follow the protocol above, using its randomness R for selecting p, f3, 7 , xi, x 2 , x 3 , 
and generate an output ( q , (p, /, g) as follows: 

• The queries q are qo = v~s to the first prover and q\ = xi to the second prover. 

• The predicate <p - rejects iff at least one of the tests in Items 4b and 4c reject. 

• The function g computes As(xi) (for the consistency test in Item 4a). 

• The functions fi ,..., 1 - compute .4 5 ( 0 ,;) for % = 1, ...,£ + 1. 

Lemma 6.9 (Perfect Completeness). The verifier has perfect completeness. Namely, for every a e 
<f> _ 1 (l), there is a proof II such that for every j € and every random string R e { 0 , 1 }°^“ Iog l F D, 

the verifier on input (4>, F\j, R) accepts arid outputs F\ (a ),..., Ffia), QH a (j). 

Proof Let b = F(a) and let s be the string promised in Lemma 6 . 8 . Let B : F ' 712 —> ¥ be the 
quadratic functions encodings of 7 T = aobos. For each vfi = {vfii, let A(vs) = (B(v±), B(v 2 ),... ,B(ve +8 )). 
We claim that II = (A, B) is a valid proof for a G 4>~ 1 (1): 

By definition I? is a linear function on F m2 , so A$(x) = B(x) for all x G S and in particular the 
test in Item 4a passes. Also, by definition B is the Hadamard encoding of the string a = no (tt® 7 r), 
so B(si) = Oi for all 1 < i < m + m 2 . Thus 

^(£*1771+12) — im +*2 — ^ 6 ] ‘ ^"*2 — ^*1 ’ ^*2 — ’ -^(^*2) 
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which, by linearity, implies that the test in Item 4c passes. Next, for Item 4b, we know that for 
every p generated by Vo, 

n n 

0 = p(n) = a 0 + ^2 aiiTi + ^ 0^7^/ = a 0 + ^ a-iBQi) + ^ au'B(£ im+il ) = a 0 + B(z), 
i =1 i,i '=1 i ii' 

so As(z) + q:q = B(z) + Go = 0 as required. It is finally easy to check that 

As(^i+n] — — 7Tj_|_ n — bi , i — l,. . . , 

Finally, for the t + 1st output, 

n n n 

^sfw+i) = B(og+ i) = 6iB(ei ) + EE B(£im+i') — QHa(j) 

i =1 i= 1 i'=1 

where the last equality is due to the fact that the QH encoding of 7r = a o b o s contains the QH 
encoding of a. More precisely, QH a (£ in+i >) = B(£ im+i i) for all 0 < i < n and 1 < i' < n. TT 

Lemma 6.10 (Distributional Soundness). The verifier above has soundness error at most 6 = |F| -01 . 
Namely, given (4>, F)for every proof Ti = ( A, B), there are functions II(-), x(-) such that 

• For each R, either <f >(x(R)) = 1 and n(f?) is a valid proof for "x e SAT(< f>)" or II(f?) = _L. 

• For every j, there is probability at least 1 — e that when R is chosen randomly and V is run on 
(<f>, F; j, R) it either rejects, or n(fi) is a proof that completely agrees with the answers of the provers 
A, B on the queries ofV (in ivhich case V's output is consistent with x(R)). 

Proof Fix II = ( A , B). Given B, let gi, ..., gL be as in the low degree test below. Lemma 6.11. Let 

L* = {i e [L\ | gi = QH n for -it = a o b o s s.t. Pc\Vq accepts] = 1} . 

Set FI(i?) = _L if events El or E 2 occurred, where 

El: B(x i) 0 {gfx i) | i € L*}. 

E2: there is more than one index i G L* for which B(x i) = g r (.X]). 

Otherwise, there is a unique i € L* such that B(x i) = g, (x i). By assumption g, is the QH encoding 
of some ir = a o b o s for which <F(o) = 1 and F(a) = b and s = s(a, b). So we set x(R) = a and set 
Il(f?) = (Ajt, Br) to be a valid proof for a G 4> _1 (1) so that Br = g j. 

Now fix an arbitrary j G W rl+n , and let R be chosen uniformly at random. We claim that the 
probability that the verifier accepts and yet the view of II and of II(f?) differ is very small. We 
analyze two cases. 

• Accept and Fl(R) = _L: This event can be bounded by 

Pr[Accept and El] + Pr[E2] < max ^2/ |IF| 1//6 , + {^j / l®1 

where the second item is bounded due to the large distance of the Hadamard code, and the 
first item is bounded as follows. If B(x i) ^ {gi(x i) | i G [L]} then Lemma 6.11 implies that 
the probability of acceptance is small. If however B(x i) = gt(x i) for some i G [L] \ L* then 
for each i G [L\ \ L* Lemma 6.12 shows that the acceptance probability is small, and we take 
a union bound over all such i. 
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• Accept and n(i?)| g / n| g : We defined n(i2) so that Br(x i) = B(x i) = gfxf) for some 
i G L*. So this event occurs if As f g/s- We observe that this event is contained in U,; 6 /\- E t 
where Ei is the event that As f gi\s yet As(x\ ) = g, (x \). For each i this event has probability 
at most 2/ |F|, and we take a union bound over i G L*. 


p 

The proof of soundness is based on the following lemma, which has appeared in several places 
in the literature. The following lemma appears in [MR10, Proposition 11.0.3]. 

Lemma 6.11 (Subspace vs. Point - linearity testing list decoding soundness). Let 5 = 2/ F l/f ’. 
Given a pair ofprovers A, B, there is a list of L < 2/<5 3 linear functions gi,... ,gL : IF™ -2 — > F such that 
the probability that the decoder does not reject yet B(x i) 0 {< 7 i(xi),..., 5 l(xi)} is at most 0(6). 

The following claim shows that if B 's answers are a linear function, then the verifier rejects 
unless B is a QH encoding of a valid proof. 

Lemma 6.12. Suppose that B : F m2 —> F is a linear function. Let tt = a o b o s be defined by 

a = B(e i)... B(e n ) and b = B(e n+ 1 ),..., B(e n+ f) and s = B(s n+ g + i), ■ • •, B(e m ). 

Assume that either 4>(a) = 0 or F(a ) fborsf s(a , b) or B f QH w . Then, for all provers A, for all j, 
Pi'if,[lF j 4 ’ B (<l },F-,j;R) accepts] < 4/ |F|. 

Proof. Assume first that B = QH n , but either <P(a) = 0 or F(a) f b or s f s(a, b ). By Lemma 6 . 8 , 
when choosing a random quadratic p, there is at most probability 2 / |F| that p(ir) = 0. So let p be 
such that p(n) f 0. Since B is the QH encoding of n, by the definition of z 

B(z) + «o = p(tt) f 0. 

However, V accepts so Item 4b passing implies that As(z) + o:o = 0. This means that as linear 
functions on S, .4 5 f B\s- It remains to observe that conditioned on S, x\ is drawn almost 
uniformly from S, so the probability that Item 4a does not reject is at most 1/ |F| + neg < 2/ |F|. 
Altogether the total probability of accepting in this case is at most 4/ |F|. 

We move to analyze the case where 4>(a) = 1 and F(a) = b and s = s(o, b) but B f QH n . 
There must be some indices i?, such that 5(ej 1 )S(ej 2 ) f B(ei im+ i 2 ). We need to upper bound 
the probability over random /?, 7 that the following expression is zero: 

m m 

B(ui)B(u 2 ) - B(uf) = EE PiTi' (B(sf)B(Stf ) .B(£j m _|_j/)). 

i= 1 i '=1 

Let us fix the value of ff (for i f if) and y t > (for i' f if) arbitrarily. The remaining expression 
becomes a non-zero quadratic polynomial in ^, 7 ^, so it can be zero with probability at most 
2/ |F| over the choice of f t] , 7 j 2 . 

Consider the event where it is not zero. Since Item 4c accepts, As(uf)As(u 2 ) = As(u 3 ) so 
As(ui) f B(uf) for some i G {1,2,3}. So as linear functions .4 5 f B\s and the probability 
of Item 4a passing is at most 1/ |F| + neg < 2/ |F| (where neg is a small probability introduced 
because x\ is only almost uniform in S conditioned on S). Altogether we get a bound of 4/ |F| in 
this case as well. □ 
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6.3 Reed-Muller based dPCP 


Theorem 5.2 (Restated) (Reed-Muller based dPCP) For any finite field F, and parameter li such that 
1 < h < |F | 0 - 01 and any £ > 0, there is a 2-prover £ + 1 -answer decodable PCP V with respect to 
the encoding LDEp ,hfor the language Alg-CktSATf with the follozving parameters: On inputs (i) a 
predicate $ : F n —> {0,1} and (ii) functions F\. . . . , Fp : F n —> F gwen by arithmetic circidts over F 
zvhose total size is N, the dPCP V has (let m = log N/ log h) 

• randomness complexity 0(logN + mlog |F|) = 0(log N + log |F|), 

• anszver size s, s' = 0(m(m + £)), 

• and distributional soundness error 1/|F| 01 . 


Fix H C F throughout this section and denote h = \H\. 

We construct a PCP decoder that receives as proof a sequence of low degree polynomials that 
allow it to simulate the actions of the initial verifier Vo (from Lemma 6 . 8 ) using fewer queries. We 
first construct this sequence of polynomials 771 , 772 , < 73 , < 74 , then describe a "verification protocol" 
checking that a given sequence of polynomials have the intended form, and finally describe the 
PCP decoder. 

Constructing the low degree functions Let 4>, F\, ..., Fp be the input. 

1. Suppose a £ < 1 )- 1 (1) and let bp = Fp(a) for all * = 1,..., £, and let s = s(a , b) so that the initial 
verifier Vq accepts tt = a o bo s with probability 1 . Wlog we assume that n = |a| is a power of 
h, and also ni = 1 7 r| + 1 is a power of h. This can be arranged by padding a with zeros and 
then padding 7 r with zeros and changing Vq accordingly. 

2. Let mi = m = log/, n and define <71 = LDE a : F mi —> F (see Definition 6.3), 

3. Let m 2 = logy, ri\ and let 7/2 = LI)E no \ : F m2 —> F be the low degree extension of the 
string obtained by appending a 1 to 7 r. By Claim 6.4 772 (^ 1 ,..., x mi ,0 ) = gi(x±,, x mi ). Let 
zo £ E 7 " 2 be the point associated with the last element in tt o 1 , i.e. such that 772 (^ 0 ) = 1 - 

4. Let m 3 = 2 m 2 and let 773 : F m3 —> F be defined by g^{x,y) = < 72 (tc) • 772 ( 77 )- Note that the 
degree of 773 is at most m^h. 

5. Let Vo be the set of all quadratic polynomials generated by Vo on input (4>. F). Fix some 
p G Pq, p(h,.. ,,t n 1 ) = Po +JEiPiti + T.ii' Pii'Uti'. Define the function p : F ms o F as 
follows. For 1 < i < Ii rn ' 2 let i be the corresponding element in II"' 2 (see discussion before 
Definition 6.3). For each i < i' G H ni2 \ {zo}, set 

p(z 0 , Zo) = Po , p(zo, 1 ) = Pi, p{i, ?) = Put, p(z) = 0 for all other z G H ms . 

Extend p from H m 3 to F ms by interpolation. The degree of p is at most rrvfi. 

This definition ensures that for a := (n o 1 ) £ F ni , 

P{v) =Po + ^Pm F^Pa'crm' = ^2 p{x) ■ g 3 (x) = 0. (6.1) 

i ii' x^H 171 ^ 
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6 . Define low degree functions Sm 3 ■ F "' 3 —> F as nested partial sums of 773 as follows. 

s m 3 ( x ) = p( x ) • 93 (x) and sf_ 1 (®) = ^ sf (xi,..., x;_i, h, 0 ,..., 0 ) 1 < i < m 3 

heH 


The degree of each sf is at most 2rn :i h. 

7. Bundling: From the polynomials g% and s 1 ’ for each i and p E Pq, we will now create one 
single polynomial g 4 that 'bundles' them together. Let us number them as q\,.... qr for 

T = m 3 \P 0 \ + 1 and let t = [log h (T + 1 )] = 0(7773). 

Let 777.4 = m3 + t and define 54 : F m4 —> F by 


T 

54(2/1, ■■■,yu x ) = ^Qi( x ) ■ Wi(yi, ■■■,yt ) ( 6 . 2 ) 

2=1 

where Wi : F* —> F is the degree th polynomial for which '«;,;(// 1 ..... ig) = I iff y \..... ig is the 
H- ary representation of i, and zero for all other y\ ..... y t E H 1 . The degree of f /4 is at most 

d = ht + 2/77773 = 0 { hm ). 

By construction the function .7/4 contains inside of it (as restrictions) the functions g\. g-i, g?;. 
Claim 6.13. There is a sequence of 1-1 (linear) mappings 


jpmi jpm 2 jpm 3 ]p m 4 


such that for each x E F ms we have gi{crz{x)) = g:i(x); and for each x E F m2 we have 53(02(2;)) = g2(x); 
and for each x E F mi rwe /zaue g 2 (ai(x)) = gi(x). □ 

Proof We map a point x'i E F mi to (xi, 0 ) E F m2 . We map a point x 2 E F ma to (20, x 2 ) E F ms . We 
map a point x 3 E F ms to (y, .7:3) E F" 1 ' 1 in the domain of 54, where y E F* is the index of 7/3 in the 
bundling. □ 

Answers of the B prover will correspond to point-evaluations of 774, and answers of the A 
prover will correspond to restrictions of 54 to certain low-degree curves. A low degree curve, see 
Definition 6 . 5 , is specified by a tuple of points in F m4 through which it passes. This tuple contains 

• Points for the verification check protocol, see below 

• Output points: The are 6+1 points whose values will give 6 + 1 answers for the decoder. 
These answers are the values of 61,..., bi and the j-th element in the encoding LDE a . 

Let vi,...,vg E F m2 be the points in the domain of g 2 that correspond to 61,..., bg. For each 
7, let o r = 0-3(779(7,',;)) be the corresponding point in the domain of 54 (as in the claim above). 

Let 7^ + i E F mi be the jth point in the domain of g\ = LDE a (we assume some canonical 
numbering of the indices of the LDE encoding). Let og + \ = 773(772(777(t^ + i))) be the corre¬ 
sponding point in the domain of 54. 

• Random points 
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Verification Protocol The verification protocol accesses functions 53 and {s p } ip and checks (lo¬ 
cally) that they have the correct form, as intended in the construction, i.e. that there is some valid 
proof 7 r such that they are equal to 53 and A- as in the construction above. 

1. Check that 53 ( 20 , zq) = 1 . 

2. Choose two random points 1 , 1/6 F ma , so that (x, y) £ F ms . Check that 53 ( 2 : 0 , x) ■ 53 ( 20 , y) = 
93 (x,y). 

3. Choose a random quadratic p by simulating Vq, and compute p : F ms —> F as in Item 5 in the 
expected proof. 

4. Do the sumcheck: Choose a random point x = (x±,..., x rn:i ) £ F”'" 3 , and do 

(a) Check that §m 3 (x) = p(x) ■ 53 (x) 

(b) For each 1 < i < m 3 check that sf_ 1 (xi,.. .,Xi- 1 , 0 ) = J2heH sf(zi, • • • > x i- 1 , K 0) 

(c) Check that YlheH 0) = 0. 

The verification protocol accesses k = (h + 1 jm/j + 5 points in the domains of 53 and s p t . Let 
u \,..., Uk £ F m4 be the corresponding points in the domain of 54 (as in Claim 6.13). 

The PCP Decoder protocol 

1. Compute the output points 01 ,..., o^+i as above. 

2. Use the randomness R to compute u \,..., um using the verification protocol. 

3. Use the randomness R to choose x\, X 2 , £3 £ F m4 uniformly. Let 7 = 'y 0l ,...,o e+1 ,u 1 ,...,u M -,x 1 ,x 2 ,x 3 
be the manifold as in Definition 6 . 6 , such that 7 contains the points 01 ,..., o/ :+ 1 , u \,..., um 
as well as xi,X 2 ,xs and has degree at most l+l + k-\-l=l + O(hm). Send 7 to A and 
let A’s answer , 4 ( 7 ) be the coefficients of a function F 4 —» F whose degree is at most d! < 
d(M + £ + 2). This function is supposed to equal B 07 . 

Let : Im{ 7 ) —> F be defined for each x £ Im( 7 ) as A^(x) := 21 ( 7 )(t) where x = 7 (t). 
Clearly A 7 can be computed from A ( 7 ). 

4. Send x\ to the B prover and let B(x 1 ) be its answer. Reject unless A 1 {x\) = B(x 1 ). 

5. Simulate the checks of Item 4 using the values A 1 (u \),..., A 1 {um)- Reject unless all of the 
checks succeed. 

6 . Output Ay(oi), . . . , Ay( 0 £+l). 

To summarize, the PCP decoder computes ( 5 , ip, f, g) as follows: 

• The queries q: qo = 7 is the query to the A prover and q\ = x,\ is the query to the B prover. 

• The predicate ip rejects unless all of the checks in Item 4 pass. 

• The function 5 computes A 1 {x\) (for the consistency test). 
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• The functions /i,..., ft-\ - compute A 1 {of) for i = 1 ,..., l + 1 . 

This completes the description of the PCP decoder, and we proceed to prove its correctness. 

Lemma 6.14 (Perfect Completeness). The PCP decoder has perfect completeness. Namely, for every 
a £ 4> _ 1 (1), there is a proof U such that for every j £ F m and every random string R, the verifier on input 
(<f>, F;j, R) accepts and outputs Fi(a),..., Fi(a), LDE a (j). 

Proof. If <f> (a) = 1 and F(a) = b then there is a proof vr = abs £ F" 1 such that for every quadratic 
p generated by the initial verifier Vo, p(ir) = 0. Compute from tt the function <74 as described in 
the "expected proof" section above, and let B answer according to < 74 . The checks in Item 4 will 
always succeed. It remains to take A to be the restrictions of B to the manifolds and then the 
consistency checks will pass and the verifier will always output as required. □ 

Lemma 6.15 (Distributional Soundness). The verifier above has soundness error at most 6 = |F| _(U . 
Naznely, given (<F, F) for every proof U = (A, B), there are functions IL(-), x(-) such that 

• For each R, either <$>(x(R)) = 1 and n(f?) is a valid proof for "x £ SAT(&)" or II(f?) = _L. 

• For every j, there is probability at least 1 — e that when R is chosen randomly and V is run on 
(<f>, F; j , R .) it either rejects, or 11(1?) is a proof that completely agrees with the anszvers of the provers 
A, B on the queries ofV (in which case V's output is consistent with x(R)). 

Proof. Fix II = (A, B). Given B, let Q 1 ,.. ■ ,Ql be degree < d functions as in Lemma 6.7. We say 
that Qi is a valid proof for a £ 4> _ 1 (1) when the B prover answers according to Q % , there is an A 
prover causing the verifier to always output consistently with LDE a . Let I C [L\ be the indices 
for which Qi is a valid proof for some a, b. 

For each R note that in the verifier protocol x \ is chosen (based on R but) independently of j. 
Set W(R) = _L if events El or E 2 occurred, where 

El: B(x 1 ) 0 {Qi(x 1 ) | i £ I}. 

E2: there is more than one index i £ I for which B(x\) = Qfx 1 ). 

Otherwise, there is a unique i £ / such that B(x\ ) = Qifxf). By assumption Q, is a valid proof for 
some a £ 4> -1 (l) so we set x(R) = a and set n(h!) = (Ar, Br) to be a valid proof for a. 

Now fix an arbitrary j £ F m , and let R be chosen uniformly at random. We claim that the 
probability that the verifier accepts and yet the view of II and of IL(T?) differ is very small. We 
analyze two cases. 

• Accept and TL(R) = _L: This event can be bounded by 

PrfAccept and El] + Pr[£’2] < max (0(|F|)~ ai ), 0(Lmd/ |F|)) + ■ d/ |F| 

where the second item is bounded due to the large distance between degree d functions, 
and the first item is bounded as follows. If B(x 1 ) f {Q, (x 1 ) | i £ [L ]} then Lemma 6.7 with 
parameters m = m^k! = k + £ = ()(hm), <1 implies that the probability of acceptance is at 
most 

(mk’d/ |F|) 1/S = 0(h 2 m 3 |F |) 1/8 < (Fp 0 ' 1 
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(the last inequality is true since h < |F | 0 ' 01 and for large enough n since m = log n/ log h and 
|F| 2 > poly log n.) 

If however B(x i) = Qi(x i) for some * G [L\ \ I then for each i e [L\ \ I Lemma 6.16 below 
shows that the acceptance probability is at most 0(md/ |F|), and we take a union bound over 
all such i. 

• Accept and n(i?)| g f n| g : We defined 11(1?) so that Br(xi) = B(x i) = Qi(x i) for some i e I. 
So this event occurs if A y f Q,\ y . We observe that this event is contained in U , G j E, where E, 
is the event that A y f Q t | 7 yet A y (x \) = (x \). For each i this event has probability at most 
dd!/ |F|, and we take a union bound over i £ I. The total probability of error in this event is 
at most Ldd! / |F|. 


□ 

Lemma 6.16 (Soundness against a low degree prover). Suppose that B : F 7 " 4 — > F is a function of 
degree at most d = ht + 2hm 3, and let g, {s?} be its unbundling. Suppose further that g is consistent with 
a, b such that either <F(o) = 0 or b f F(a). Then, for all provers A, the probability that the verifier accepts 
is at most 0(md/|F|). 

Proof (of Lemma 6.16) Assume that <F(o) = 0 or F(a) 7 ^ b and denote a = abs. The probability 
that a random quadratic p drawn according to Vo (from Lemma 6 . 8 ) will satisfy p(a) = 0 is at most 
0(1/ |F|). Suppose p(a) f 0. This means that 

v(x)g(x) f 0. (6.3) 

x£H m 3 

Observe that if the check in Item 4c passes then either 

4 + P ■ 9, (6-4) 


or, for some i, as functions of x\,, .x,_ 1 , 

• • ■ ,Xi-i,0) 7 ^ Y s%( x i,---,xi-i,h,0). (6.5) 

heH 

Otherwise, 

Y P( x )s(x)= Y s m 3 (xi,...,x m3 ) = 

x£H m 3 X\,...,Xm 3 &H 

= Y ^3_i(xi,...,x m3 _i,0) = ... = Y a^s-itei.O) = 0 

xi,...,Xm 3 -i£H xiG H 

contradicting (6.3). The verifier checks each of these m 3 equalities in (6.4) and (6.5)) on a random 
point (in Items 4a and 4b), so the probability of acceptance is at most m 3 ■ |4. □ 
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